evolcore 0.0.16 → 0.0.18

package/dist/core/permission/sandbox-runtime.js

@@ -4,7 +4,42 @@ import { resolveCommandPath } from '../../utils/cross-platform.js';
 import { getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameOrDescendant, } from '../protected-paths.js';
 import { resolveRoot } from '../../paths.js';
 let cachedBubblewrapPath;
+let sandboxInitializationCircuit;
+let sandboxCircuitNoticeAt = 0;
 export const SANDBOX_INITIALIZATION_FAILED = 'sandbox_initialization_failed';
+export const SANDBOX_INITIALIZATION_COOLDOWN_MS = 5 * 60 * 1000;
+export const SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS = 60 * 1000;
+/** Open a process-wide fail-closed circuit after a confirmed host bootstrap failure. */
+export function recordSandboxInitializationFailure(error, stderr = [], now = Date.now()) {
+    const detail = createSandboxInitializationError(error, stderr).message.slice(0, 512);
+    sandboxInitializationCircuit = sandboxInitializationCircuit
+        ? {
+            ...sandboxInitializationCircuit,
+            lastObservedAt: now,
+            occurrences: sandboxInitializationCircuit.occurrences + 1,
+            detail,
+        }
+        : { openedAt: now, lastObservedAt: now, occurrences: 1, detail };
+    return { ...sandboxInitializationCircuit };
+}
+/** Return an active failure circuit, or allow one probe after the cooldown. */
+export function getActiveSandboxInitializationFailure(now = Date.now(), cooldownMs = SANDBOX_INITIALIZATION_COOLDOWN_MS) {
+    if (!sandboxInitializationCircuit)
+        return undefined;
+    if (now - sandboxInitializationCircuit.lastObservedAt >= cooldownMs) {
+        sandboxInitializationCircuit = undefined;
+        sandboxCircuitNoticeAt = 0;
+        return undefined;
+    }
+    return { ...sandboxInitializationCircuit };
+}
+/** Rate-limit human-readable warnings; structured audit still records every blocked task. */
+export function shouldLogSandboxCircuitNotice(now = Date.now(), intervalMs = SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS) {
+    if (sandboxCircuitNoticeAt && now - sandboxCircuitNoticeAt < intervalMs)
+        return false;
+    sandboxCircuitNoticeAt = now;
+    return true;
+}
 /** Recognize sandbox bootstrap failures independently of localized stderr. */
 export function isSandboxInitializationFailure(error, stderr = []) {
     const text = [error instanceof Error ? error.message : String(error ?? ''), ...stderr]
@@ -14,9 +49,18 @@ export function isSandboxInitializationFailure(error, stderr = []) {
         || /(?:apply-seccomp|seccomp)[\s\S]*(?:uid_map|gid_map|operation not permitted)/.test(text)
         || /(?:uid_map|gid_map)[\s\S]*(?:operation not permitted|permission denied)/.test(text)
         || /user namespace[\s\S]*(?:not permitted|unavailable|failed)/.test(text)
-        || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text);
+        || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text)
+        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot|unable to)[\s\S]*(?:bind|mount|mount table)/.test(text);
 }
 export function createSandboxInitializationError(error, stderr = []) {
+    if (error instanceof Error
+        && (error.code === SANDBOX_INITIALIZATION_FAILED
+            || error.message.includes(`${SANDBOX_INITIALIZATION_FAILED}:`))) {
+        error.code = SANDBOX_INITIALIZATION_FAILED;
+        if (stderr.length > 0)
+            error.stderr = [...stderr].slice(-20);
+        return error;
+    }
     const detail = error instanceof Error ? error.message : String(error ?? 'sandbox bootstrap failed');
     const wrapped = new Error(`${SANDBOX_INITIALIZATION_FAILED}: ${detail}`);
     wrapped.name = 'SandboxInitializationError';
@@ -211,6 +255,16 @@ function appendRuntimeBackedEtcFiles(args) {
         args.push('--ro-bind', candidate, resolved);
     }
 }
+function appendContainerEtcFileBinds(args) {
+    for (const candidate of ['/etc/resolv.conf', '/etc/hosts', '/etc/hostname']) {
+        if (!fs.existsSync(candidate))
+            continue;
+        // A directory bind does not recursively preserve OCI/container-runtime
+        // file mounts. Rebind only the three standard runtime-injected files after
+        // /etc becomes readonly; no other /etc mount is carried into the guard.
+        args.push('--ro-bind', candidate, candidate);
+    }
+}
 function appendHClassMasks(args, root, maskContainerSockets) {
     for (const target of getExistingHClassMaskTargets(root)) {
         if (target.kind === 'directory')
@@ -251,20 +305,30 @@ export function buildHClassGuardCommand(executable, executableArgs, root = resol
             throw new Error(`Codex managed requirements is not a file: ${requirements}`);
         }
         const managedDirectory = path.dirname(requirements);
+        const systemConfigDirectory = '/etc/codex';
+        let systemConfigStat;
+        try {
+            systemConfigStat = fs.lstatSync(systemConfigDirectory);
+        }
+        catch {
+            throw new Error(`Codex managed requirements mountpoint is unavailable: ${systemConfigDirectory} `
+                + 'must be created as a real directory during installation');
+        }
+        if (!systemConfigStat.isDirectory() || systemConfigStat.isSymbolicLink()) {
+            throw new Error(`Codex managed requirements mountpoint is unsafe: ${systemConfigDirectory} `
+                + 'must be a real directory');
+        }
         // Keep the copied hook immutable even when a session uses bypass mode.
         args.push('--ro-bind', managedDirectory, managedDirectory);
-        // A host may not have /etc/codex yet. Overlay /etc inside this namespace so
-        // Bubblewrap can create the mountpoint without modifying the host, while
-        // retaining the complete host /etc as the read-only lower layer.
-        args.push('--overlay-src', '/etc');
-        args.push('--tmp-overlay', '/etc');
-        args.push('--dir', '/etc/codex');
-        // Replace the complete Codex system-config directory inside this app-server
-        // namespace so host system hooks cannot join EvolCore's managed hook set.
-        args.push('--tmpfs', '/etc/codex');
-        args.push('--ro-bind', requirements, '/etc/codex/requirements.toml');
-        args.push('--remount-ro', '/etc/codex');
-        args.push('--remount-ro', '/etc');
+        // The guard starts from a writable root so owner-bypass workspaces keep
+        // their normal semantics. Make the system configuration tree readonly
+        // before replacing only Codex's directory, so a root daemon cannot write
+        // unrelated files under /etc from inside this namespace.
+        args.push('--ro-bind', '/etc', '/etc');
+        appendContainerEtcFileBinds(args);
+        // Replace only Codex's system-config directory. Requiring the mountpoint to
+        // exist prevents Bubblewrap from creating it on the writable host root.
+        args.push('--ro-bind', managedDirectory, systemConfigDirectory);
     }
     args.push('--', executable, ...executableArgs);
     return { command: bubblewrapPath, args };
@@ -304,4 +368,6 @@ export function buildBubblewrapCommand(executable, executableArgs, options) {
 }
 export function _resetSandboxRuntimeCache() {
     cachedBubblewrapPath = undefined;
+    sandboxInitializationCircuit = undefined;
+    sandboxCircuitNoticeAt = 0;
 }

package/dist/core/permission/tool-policy.js

@@ -1148,7 +1148,7 @@ export function checkLClassWrite(toolName, input, context) {
                 behavior: 'deny',
                 message: context?.permissionMode === 'readonly'
                     ? '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径'
-                    : '🔒 L-class 路径仅允许受限、可证明只读的命令；未知 Shell 语法失败关闭。修改必须通过受控的 EvolCore 命令',
+                    : '🔒 L-class 路径允许读取，但当前 Bash 复合命令无法证明为只读，已拒绝执行。请改用受控的 EvolCore 读取命令或白名单只读命令',
             };
         }
         collectFilesystemWriteGrantPaths(input.additionalPermissions, writeGrantPaths, projectRootWriteSubpaths);