evolcore 0.0.14 → 0.0.15

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.15 (2026-08-25)
+
+### Codex 文件授权
+
+- 文件变更的临时授权按 canonical 化后的完整目标文件集合匹配，变更内容或顺序调整不再扩大授权范围。
+- 统一 Codex 文件授权的交互反馈，明确区分同文件临时授权与同操作临时授权，并收紧跨会话授权契约。
+
+### 运行安全与审计
+
+- 为 Claude、Codex 和 ecagent 的工具预检拒绝统一补充结构化授权审计，便于追踪策略、请求和会话上下文。
+- 规范 Codex 审批命令与委派校验，拒绝无法规范化的复合命令和空字节输入，并修正 Windows 受管临时目录的私有性校验。
+
 ## 0.0.14 (2026-08-24)
 
 ### Codex 受管运行与安全

package/dist/agents/codex-runner.js

@@ -2430,6 +2430,9 @@ export class CodexRunner {
         if (requiresSandboxExpansionApproval) {
             if (!this.permissionGateway || !permissionPrompt)
                 return 'deny';
+            if (toolName === 'FileChange') {
+                return this.permissionGateway.requestPermission(sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope, undefined, { fileChangeCwd: workspacePath });
+            }
             return this.permissionGateway.requestPermission(sessionKey, toolName, checkedInput, permissionPrompt, this.permissionContexts.get(sessionKey), summary, reason || 'Codex 请求扩大当前命令或 turn 的文件系统权限', grantScope);
         }
         if (mode === 'request' || mode === 'bypass') {

package/dist/channels/feishu.js

@@ -1467,9 +1467,14 @@ export function buildCardV2(interaction, opts) {
 export function buildResolvedV2(interaction, response) {
     const action = response.action;
     const kind = interaction.kind;
+    const temporaryGrantButton = kind.kind === 'action'
+        ? kind.buttons.find(button => button.key === 'always' || button.key === 'approve_session_30m')
+        : undefined;
+    const temporaryGrantIsFileScoped = temporaryGrantButton?.label.includes('同文件') === true;
     const labelMap = {
         'allow': '✅ 已允许',
-        'always': '⏱ 已授权同操作 30 分钟',
+        'always': temporaryGrantIsFileScoped ? '⏱ 已授权同文件 30 分钟' : '⏱ 已授权同操作 30 分钟',
+        'approve_session_30m': temporaryGrantIsFileScoped ? '⏱ 已授权同文件 30 分钟' : '⏱ 已授权本会话 30 分钟',
         'deny': '❌ 已拒绝',
         'cancel': '取消',
     };

package/dist/cli/task-context.js

@@ -47,10 +47,14 @@ function isPrivateDirectory(directory) {
     try {
         const resolved = path.resolve(directory);
         const stat = fs.lstatSync(resolved);
+        // Windows does not expose Unix ownership and permission bits through
+        // Stats.mode. The ACL is enforced by the platform, so applying the
+        // POSIX 0700 check here rejects otherwise valid Windows directories.
+        const isWindows = process.platform === 'win32';
         if (!stat.isDirectory()
             || stat.isSymbolicLink()
-            || (typeof process.getuid === 'function' && stat.uid !== process.getuid())
-            || (stat.mode & 0o077) !== 0)
+            || (!isWindows && typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            || (!isWindows && (stat.mode & 0o077) !== 0))
             return false;
         // A private leaf below a symlinked ancestor can still escape the managed
         // namespace. Walk the existing ancestor chain and reject such paths while

package/dist/core/command/slash-handler.js

@@ -705,7 +705,7 @@ export async function handleSlashCommand(content, channel, channelId, sendMessag
         const args = normalizedContent.slice(5).trim();
         const permissionDecisionLabels = {
             allow: '✓ 已授权（本次），继续执行……',
-            always: '✓ 已授权（同会话同操作 30 分钟），继续执行……',
+            always: '✓ 已授权（当前会话临时授权 30 分钟），继续执行……',
             deny: '✓ 已拒绝',
         };
         // Explicit request IDs are globally unique and already bound to an exact

package/dist/core/permission/approval-gateway.js

@@ -7,6 +7,7 @@ import { summarizeToolInput } from '../../utils/tool-summary.js';
 import { createRootCausation, deriveCausation, normalizeCausation } from '../causation/context.js';
 import { recordCausationSpan } from '../causation/audit.js';
 import { checkDangerousCommand } from './tool-policy.js';
+import { resolveProtectedCandidate } from '../protected-paths.js';
 export async function requestDangerousCommandPermission(gateway, sessionId, toolName, input, sendPrompt, context, grantScope = 'default', mode = 'request') {
     const dangerCheck = checkDangerousCommand(toolName, input);
     if (!dangerCheck.isDangerous) {
@@ -41,6 +42,76 @@ function stablePermissionInput(value) {
 function permissionInputFingerprint(input) {
     return createHash('sha256').update(stablePermissionInput(input)).digest('hex');
 }
+function collectExplicitFileChangeGrantPaths(record, output) {
+    const pathKeys = ['path', 'filePath', 'file_path', 'movePath', 'move_path', 'destinationPath', 'targetPath'];
+    const hasExplicitPath = pathKeys.some(key => typeof record[key] === 'string' && !!record[key]);
+    for (const key of pathKeys) {
+        const candidate = record[key];
+        if (typeof candidate === 'string' && candidate)
+            output.push(candidate);
+    }
+    if (record.kind && typeof record.kind === 'object' && !Array.isArray(record.kind)) {
+        collectExplicitFileChangeGrantPaths(record.kind, output);
+    }
+    return hasExplicitPath;
+}
+function collectFileChangeGrantPaths(value, output) {
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+                collectExplicitFileChangeGrantPaths(entry, output);
+            }
+        }
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    const record = value;
+    const hasExplicitPath = collectExplicitFileChangeGrantPaths(record, output);
+    if (hasExplicitPath)
+        return;
+    // Some backends encode file changes as a map keyed by path. Do not treat
+    // metadata keys as paths, and still collect explicit move destinations.
+    for (const [filePath, change] of Object.entries(record)) {
+        if (filePath !== 'kind' && filePath !== 'type')
+            output.push(filePath);
+        if (change && typeof change === 'object' && !Array.isArray(change)) {
+            collectExplicitFileChangeGrantPaths(change, output);
+        }
+    }
+}
+function permissionGrantMatch(toolName, input, options) {
+    const fileChangeCwd = options?.fileChangeCwd?.trim();
+    // grantRoot is already a broad filesystem capability. Keep it exact rather
+    // than silently widening it through the concrete-file convenience scope.
+    if (toolName === 'FileChange' && fileChangeCwd && !input.grantRoot) {
+        const rawPaths = [];
+        collectFileChangeGrantPaths(input.fileChanges, rawPaths);
+        try {
+            const canonicalPaths = [...new Set(rawPaths.map(candidate => {
+                    const canonical = resolveProtectedCandidate(candidate, fileChangeCwd);
+                    return process.platform === 'win32' ? canonical.toLowerCase() : canonical;
+                }))].sort();
+            if (canonicalPaths.length > 0) {
+                return {
+                    inputFingerprint: permissionInputFingerprint({
+                        scope: 'file-change-paths-v1',
+                        paths: canonicalPaths,
+                    }),
+                    scope: 'file-change-paths',
+                };
+            }
+        }
+        catch {
+            // Invalid path input falls back to exact matching; policy checks still
+            // decide whether the request itself may be approved.
+        }
+    }
+    return {
+        inputFingerprint: permissionInputFingerprint(input),
+        scope: 'exact-operation',
+    };
+}
 function truncateApprovalDetail(value) {
     const trimmed = value.trim();
     return trimmed.length > APPROVAL_DETAIL_LIMIT
@@ -238,13 +309,14 @@ export class PermissionGateway {
                 this.temporaryGrants.delete(key);
         }
     }
-    hasTemporaryGrant(sessionId, toolName, toolInput, grantScope = 'default') {
-        return !!this.getTemporaryGrant(sessionId, toolName, toolInput, grantScope);
+    hasTemporaryGrant(sessionId, toolName, toolInput, grantScope = 'default', matchOptions) {
+        const match = permissionGrantMatch(toolName, toolInput, matchOptions);
+        return !!this.getTemporaryGrant(sessionId, toolName, match.inputFingerprint, grantScope);
     }
-    getTemporaryGrant(sessionId, toolName, toolInput, grantScope = 'default') {
+    getTemporaryGrant(sessionId, toolName, inputFingerprint, grantScope = 'default') {
         const now = Date.now();
         this.pruneTemporaryGrants(now);
-        const key = this.temporaryGrantKey(sessionId, toolName, permissionInputFingerprint(toolInput), grantScope);
+        const key = this.temporaryGrantKey(sessionId, toolName, inputFingerprint, grantScope);
         return this.temporaryGrants.get(key);
     }
     addTemporaryGrant(pending, causation) {
@@ -425,7 +497,7 @@ export class PermissionGateway {
         }
         return true;
     }
-    async requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation) {
+    async requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation, grantMatch) {
         const approval = context.approvalRouting;
         const interactionRouter = context.interactionRouter;
         if (!approval || !interactionRouter) {
@@ -480,7 +552,11 @@ export class PermissionGateway {
                 bodyFormat: 'markdown',
                 buttons: [
                     { key: 'approve_once', label: '批准本次', style: 'primary' },
-                    { key: 'approve_session_30m', label: '本会话 30 分钟', style: 'default' },
+                    {
+                        key: 'approve_session_30m',
+                        label: grantMatch.scope === 'file-change-paths' ? '同文件 30 分钟' : '本会话 30 分钟',
+                        style: 'default',
+                    },
                     { key: 'deny', label: '拒绝', style: 'danger' },
                 ],
             },
@@ -508,7 +584,7 @@ export class PermissionGateway {
                 displaySummary,
                 reason,
                 resolve,
-                inputFingerprint: permissionInputFingerprint(toolInput),
+                inputFingerprint: grantMatch.inputFingerprint,
                 grantScope,
                 approverPolicy: challenge.approverPolicy,
                 approvalRouteKind: route.kind,
@@ -644,7 +720,7 @@ export class PermissionGateway {
     /**
      * 请求人工审批。返回三态决策。
      */
-    async requestPermission(sessionId, toolName, toolInput, sendPrompt, context, summary, reason, grantScope = 'default', approverPolicy) {
+    async requestPermission(sessionId, toolName, toolInput, sendPrompt, context, summary, reason, grantScope = 'default', approverPolicy, matchOptions) {
         const effectiveApproverPolicy = approverPolicy
             ?? context?.approvalRouting?.approverPolicy
             ?? 'requester';
@@ -672,7 +748,8 @@ export class PermissionGateway {
             await sendPrompt('当前操作需要授权，但无法验证申请人身份。');
             return 'deny';
         }
-        const temporaryGrant = this.getTemporaryGrant(sessionId, toolName, toolInput, grantScope);
+        const grantMatch = permissionGrantMatch(toolName, toolInput, matchOptions);
+        const temporaryGrant = this.getTemporaryGrant(sessionId, toolName, grantMatch.inputFingerprint, grantScope);
         if (temporaryGrant) {
             const consumeCausation = deriveCausation(normalizeCausation(temporaryGrant.causation)
                 ?? normalizeCausation(context?.causation)
@@ -731,7 +808,7 @@ export class PermissionGateway {
             return 'deny';
         }
         if (route.kind === 'handoff') {
-            return this.requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation);
+            return this.requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation, grantMatch);
         }
         // 构造 ActionInteraction
         const interaction = {
@@ -743,7 +820,11 @@ export class PermissionGateway {
                 body: `工具：${toolName}\n操作：${displaySummary}${reasonLine}`,
                 buttons: [
                     { key: 'allow', label: '✅ 允许本次', style: 'primary' },
-                    { key: 'always', label: '⏱ 同操作 30 分钟', style: 'default' },
+                    {
+                        key: 'always',
+                        label: grantMatch.scope === 'file-change-paths' ? '⏱ 同文件 30 分钟' : '⏱ 同操作 30 分钟',
+                        style: 'default',
+                    },
                     { key: 'deny', label: '❌ 拒绝', style: 'danger' },
                 ],
             },
@@ -767,7 +848,7 @@ export class PermissionGateway {
             const pending = {
                 sessionId,
                 toolName,
-                inputFingerprint: permissionInputFingerprint(toolInput),
+                inputFingerprint: grantMatch.inputFingerprint,
                 grantScope,
                 approverPolicy: challenge.approverPolicy,
                 approvalRouteKind: route.kind,
@@ -839,7 +920,10 @@ export class PermissionGateway {
                     replyContext: context.replyContext,
                     causation: requestCausation,
                 });
-                const fallbackText = `🔐 权限请求 - ${toolName}\n${displaySummary}${reasonLine}\n回复 /perm ${requestId} allow 允许本次 / /perm ${requestId} always 同操作授权 30 分钟 / /perm ${requestId} deny 拒绝`;
+                const temporaryGrantLabel = grantMatch.scope === 'file-change-paths'
+                    ? '同文件授权 30 分钟'
+                    : '同操作授权 30 分钟';
+                const fallbackText = `🔐 权限请求 - ${toolName}\n${displaySummary}${reasonLine}\n回复 /perm ${requestId} allow 允许本次 / /perm ${requestId} always ${temporaryGrantLabel} / /perm ${requestId} deny 拒绝`;
                 const result = await sendInteractionPayload(context.adapter, envelope, interaction, fallbackText, context.replyContext);
                 interactionSent = !!result;
             }
@@ -879,9 +963,8 @@ export class PermissionGateway {
         const normalizedDecision = decision === 'allow' || decision === 'always'
             ? decision
             : 'deny';
-        // Legacy "always" now means this exact operation in this session for 30 minutes.
-        // The backend receives a one-shot allow. Future identical operations must
-        // return through this gateway so the exact fingerprint and TTL are checked.
+        // The backend receives a one-shot allow. Future requests must return
+        // through this gateway so the selected match scope and TTL are checked.
         this.clearPendingResources(pending);
         pending.interactionRouter?.cancel(requestId);
         pending.resolve(normalizedDecision === 'deny' ? 'deny' : 'allow');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "evolcore",
-  "version": "0.0.14",
+  "version": "0.0.15",
   "description": "AI Agent gateway connecting Claude, Codex, Gemini, and the bundled ecagent runner to messaging channels with multi-project session management",
   "type": "module",
   "main": "dist/index.js",