evolcore 0.0.17 → 0.0.19

package/dist/core/permission/ec-command-parser.js

@@ -1,14 +1,21 @@
 const HEAD_EXECUTABLES = new Set(['head', '/bin/head', '/usr/bin/head']);
 // Codex app-server sends command executions through a fixed shell carrier.
 // Treat the carrier as syntax only after parsing it as literal argv; never
-// accept an arbitrary `sh -c` string or unwrap shell composition here.
-const CODEX_SHELL_EXECUTABLES = new Set([
+// accept an arbitrary shell command string or unwrap composition here.
+const CODEX_POSIX_SHELL_EXECUTABLES = new Set([
     'bash', '/bin/bash', '/usr/bin/bash',
     'sh', '/bin/sh', '/usr/bin/sh',
 ]);
+const CODEX_POWERSHELL_EXECUTABLES = new Set([
+    'pwsh', 'pwsh.exe', 'powershell', 'powershell.exe',
+]);
+const CODEX_POWERSHELL_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Program Files[\\/]PowerShell[\\/][0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9.-]+)?[\\/]pwsh\.exe|Windows[\\/]System32[\\/]WindowsPowerShell[\\/]v1\.0[\\/]powershell\.exe)$/i;
 const SHELL_UNQUOTED_META = new Set([
     ';', '&', '|', '`', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#',
 ]);
+const POWERSHELL_UNQUOTED_META = new Set([
+    ';', '&', '|', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#', '@',
+]);
 const AMBIGUOUS_FILE_PATH_RE = /[\0\r\n$`*?\[\]{}<>|;&]/;
 const EVOLCORE_COMMAND_POSITION_RE = /(?:^|[;&|()`])\s*ec(?=\s|[;&|()<>`]|$)/i;
 function trimShellSpacing(value) {
@@ -83,6 +90,106 @@ function isLiteralArgBoundary(value) {
 function isShellParameterExpansionStart(value) {
     return value === '(' || value === '{' || !!value && /[A-Za-z0-9_@*#?$!\-]/.test(value);
 }
+function parseLiteralPowerShellCommand(command) {
+    const input = trimShellSpacing(command);
+    if (!input)
+        return { ok: false, issue: 'empty-command' };
+    if (input.includes('\0'))
+        return { ok: false, issue: 'invalid-control-char' };
+    const argv = [];
+    let token = '';
+    let tokenStarted = false;
+    let quote = null;
+    const finishToken = () => {
+        if (!tokenStarted)
+            return;
+        argv.push(token);
+        token = '';
+        tokenStarted = false;
+    };
+    for (let index = 0; index < input.length; index++) {
+        const char = input[index];
+        if (quote === 'single') {
+            if (char === "'" && input[index + 1] === "'") {
+                token += "'";
+                index++;
+            }
+            else if (char === "'") {
+                if (!isLiteralArgBoundary(input[index + 1]))
+                    return { ok: false, issue: 'invalid-quote' };
+                quote = null;
+            }
+            else {
+                token += char;
+            }
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '"') {
+                if (!isLiteralArgBoundary(input[index + 1]))
+                    return { ok: false, issue: 'invalid-quote' };
+                quote = null;
+                continue;
+            }
+            if (char === '`') {
+                const next = input[++index];
+                if (next === undefined)
+                    return { ok: false, issue: 'invalid-quote' };
+                if (next === '\r' || next === '\n')
+                    return { ok: false, issue: 'structural-newline' };
+                token += next;
+                continue;
+            }
+            if (char === '$' && isShellParameterExpansionStart(input[index + 1])) {
+                return { ok: false, issue: 'unsafe-expansion' };
+            }
+            token += char;
+            continue;
+        }
+        if (char === ' ' || char === '\t') {
+            finishToken();
+            continue;
+        }
+        if (char === '\r' || char === '\n')
+            return { ok: false, issue: 'structural-newline' };
+        if (/\s/u.test(char) || char.charCodeAt(0) < 0x20 || char === '\x7f') {
+            return { ok: false, issue: 'invalid-control-char' };
+        }
+        if (char === "'") {
+            tokenStarted = true;
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            tokenStarted = true;
+            quote = 'double';
+            continue;
+        }
+        if (char === '`') {
+            const next = input[++index];
+            if (next === undefined)
+                return { ok: false, issue: 'invalid-quote' };
+            if (next === '\r' || next === '\n')
+                return { ok: false, issue: 'structural-newline' };
+            tokenStarted = true;
+            token += next;
+            continue;
+        }
+        const isWordInitialMeta = (char === '#' || char === '@') && !tokenStarted;
+        const isAlwaysMeta = POWERSHELL_UNQUOTED_META.has(char) && char !== '#' && char !== '@';
+        if (isAlwaysMeta || isWordInitialMeta || (char === '~' && !tokenStarted)) {
+            return { ok: false, issue: 'shell-composition' };
+        }
+        tokenStarted = true;
+        token += char;
+    }
+    if (quote)
+        return { ok: false, issue: 'invalid-quote' };
+    finishToken();
+    return argv.length > 0
+        ? { ok: true, argv }
+        : { ok: false, issue: 'empty-command' };
+}
 function doubleQuotedIssueAt(input, index) {
     const char = input[index];
     if (char === '`' || (char === '$' && isShellParameterExpansionStart(input[index + 1]))) {
@@ -102,6 +209,9 @@ function doubleQuotedIssueAt(input, index) {
  * Anything outside this subset is never granted the privileged EC path.
  */
 export function parseLiteralShellCommand(command, options = {}) {
+    if (options.dialect === 'powershell') {
+        return parseLiteralPowerShellCommand(command);
+    }
     const input = trimShellSpacing(options.allowManagedTmpDir
         ? substituteManagedTmpDirToken(command)
         : command);
@@ -209,15 +319,21 @@ export function parseLiteralShellArgv(command, options = {}) {
     const result = parseLiteralShellCommand(command, options);
     return result.ok ? result.argv : null;
 }
-/**
- * Return the command string carried by Codex's literal `/bin/bash -lc ...`
- * wrapper. The wrapper is accepted only in its exact three-argv form and the
- * caller must parse the returned string with the literal shell parser again.
- */
-export function unwrapCodexShellCommandArgv(argv) {
-    if (argv.length !== 3 || argv[1] !== '-lc')
+export function resolveCodexShellCarrierArgv(argv) {
+    if (argv.length !== 3)
         return undefined;
-    return CODEX_SHELL_EXECUTABLES.has(argv[0]) ? argv[2] : undefined;
+    if (argv[1] === '-lc' && CODEX_POSIX_SHELL_EXECUTABLES.has(argv[0])) {
+        return { command: argv[2], dialect: 'posix' };
+    }
+    const powershellExecutable = argv[0].toLowerCase();
+    const isPowerShell = CODEX_POWERSHELL_EXECUTABLES.has(powershellExecutable)
+        || CODEX_POWERSHELL_INSTALL_PATH_RE.test(argv[0]);
+    return isPowerShell && argv[1].toLowerCase() === '-command'
+        ? { command: argv[2], dialect: 'powershell' }
+        : undefined;
+}
+export function unwrapCodexShellCommandArgv(argv) {
+    return resolveCodexShellCarrierArgv(argv)?.command;
 }
 /**
  * Parse either a bare literal command or the exact shell carrier emitted by
@@ -228,8 +344,10 @@ export function parseCodexShellCommandArgv(command, options = {}) {
     const outer = parseLiteralShellArgv(command, options);
     if (!outer)
         return null;
-    const wrapped = unwrapCodexShellCommandArgv(outer);
-    return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped, options);
+    const carrier = resolveCodexShellCarrierArgv(outer);
+    return carrier === undefined
+        ? outer
+        : parseLiteralShellArgv(carrier.command, { ...options, dialect: carrier.dialect });
 }
 /**
  * Resolve a Codex command input while preserving the raw `commandArgv` form
@@ -239,10 +357,13 @@ export function parseCodexShellCommandArgv(command, options = {}) {
 export function parseCodexToolCommandArgv(input) {
     if (Array.isArray(input.commandArgv) && input.commandArgv.every(value => typeof value === 'string')) {
         const outer = input.commandArgv;
-        const wrapped = unwrapCodexShellCommandArgv(outer);
-        return wrapped === undefined
+        const carrier = resolveCodexShellCarrierArgv(outer);
+        return carrier === undefined
             ? outer
-            : parseLiteralShellArgv(wrapped, { allowManagedTmpDir: true });
+            : parseLiteralShellArgv(carrier.command, {
+                allowManagedTmpDir: true,
+                dialect: carrier.dialect,
+            });
     }
     const command = typeof input.command === 'string' ? input.command : '';
     return parseCodexShellCommandArgv(command, { allowManagedTmpDir: true });
@@ -924,24 +1045,29 @@ export function parseBoundedOutputShellCommand(command) {
  * policy must not interpret EC subcommands or arguments: a single literal
  * invocation may leave the sandbox, while shell composition may not.
  */
-export function classifyEvolcoreShellCommand(command) {
-    const parseOptions = { allowManagedTmpDir: true };
+export function classifyEvolcoreShellCommand(command, options = {}) {
+    const parseOptions = { allowManagedTmpDir: true, ...options };
     const literal = parseLiteralShellCommand(command, parseOptions);
     if (literal.ok) {
         if (literal.argv[0] === 'ec')
             return { kind: 'literal' };
-        const wrapped = unwrapCodexShellCommandArgv(literal.argv);
-        if (wrapped !== undefined) {
-            const nested = parseLiteralShellCommand(wrapped, parseOptions);
+        const carrier = resolveCodexShellCarrierArgv(literal.argv);
+        if (carrier !== undefined) {
+            const nested = parseLiteralShellCommand(carrier.command, {
+                ...parseOptions,
+                dialect: carrier.dialect,
+            });
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
-            if (!nested.ok && EVOLCORE_COMMAND_POSITION_RE.test(wrapped)) {
+            if (!nested.ok && EVOLCORE_COMMAND_POSITION_RE.test(carrier.command)) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
         return { kind: 'none' };
     }
-    const boundedOutput = parseBoundedOutputShellCommand(command);
+    const boundedOutput = options.dialect === 'powershell'
+        ? null
+        : parseBoundedOutputShellCommand(command);
     if (boundedOutput && boundedOutput.argv[0] === 'ec') {
         return { kind: 'bounded-output', command: boundedOutput };
     }

package/dist/core/permission/sandbox-runtime.js

@@ -4,7 +4,42 @@ import { resolveCommandPath } from '../../utils/cross-platform.js';
 import { getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameOrDescendant, } from '../protected-paths.js';
 import { resolveRoot } from '../../paths.js';
 let cachedBubblewrapPath;
+let sandboxInitializationCircuit;
+let sandboxCircuitNoticeAt = 0;
 export const SANDBOX_INITIALIZATION_FAILED = 'sandbox_initialization_failed';
+export const SANDBOX_INITIALIZATION_COOLDOWN_MS = 5 * 60 * 1000;
+export const SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS = 60 * 1000;
+/** Open a process-wide fail-closed circuit after a confirmed host bootstrap failure. */
+export function recordSandboxInitializationFailure(error, stderr = [], now = Date.now()) {
+    const detail = createSandboxInitializationError(error, stderr).message.slice(0, 512);
+    sandboxInitializationCircuit = sandboxInitializationCircuit
+        ? {
+            ...sandboxInitializationCircuit,
+            lastObservedAt: now,
+            occurrences: sandboxInitializationCircuit.occurrences + 1,
+            detail,
+        }
+        : { openedAt: now, lastObservedAt: now, occurrences: 1, detail };
+    return { ...sandboxInitializationCircuit };
+}
+/** Return an active failure circuit, or allow one probe after the cooldown. */
+export function getActiveSandboxInitializationFailure(now = Date.now(), cooldownMs = SANDBOX_INITIALIZATION_COOLDOWN_MS) {
+    if (!sandboxInitializationCircuit)
+        return undefined;
+    if (now - sandboxInitializationCircuit.lastObservedAt >= cooldownMs) {
+        sandboxInitializationCircuit = undefined;
+        sandboxCircuitNoticeAt = 0;
+        return undefined;
+    }
+    return { ...sandboxInitializationCircuit };
+}
+/** Rate-limit human-readable warnings; structured audit still records every blocked task. */
+export function shouldLogSandboxCircuitNotice(now = Date.now(), intervalMs = SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS) {
+    if (sandboxCircuitNoticeAt && now - sandboxCircuitNoticeAt < intervalMs)
+        return false;
+    sandboxCircuitNoticeAt = now;
+    return true;
+}
 /** Recognize sandbox bootstrap failures independently of localized stderr. */
 export function isSandboxInitializationFailure(error, stderr = []) {
     const text = [error instanceof Error ? error.message : String(error ?? ''), ...stderr]
@@ -14,9 +49,18 @@ export function isSandboxInitializationFailure(error, stderr = []) {
         || /(?:apply-seccomp|seccomp)[\s\S]*(?:uid_map|gid_map|operation not permitted)/.test(text)
         || /(?:uid_map|gid_map)[\s\S]*(?:operation not permitted|permission denied)/.test(text)
         || /user namespace[\s\S]*(?:not permitted|unavailable|failed)/.test(text)
-        || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text);
+        || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text)
+        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot|unable to)[\s\S]*(?:bind|mount|mount table)/.test(text);
 }
 export function createSandboxInitializationError(error, stderr = []) {
+    if (error instanceof Error
+        && (error.code === SANDBOX_INITIALIZATION_FAILED
+            || error.message.includes(`${SANDBOX_INITIALIZATION_FAILED}:`))) {
+        error.code = SANDBOX_INITIALIZATION_FAILED;
+        if (stderr.length > 0)
+            error.stderr = [...stderr].slice(-20);
+        return error;
+    }
     const detail = error instanceof Error ? error.message : String(error ?? 'sandbox bootstrap failed');
     const wrapped = new Error(`${SANDBOX_INITIALIZATION_FAILED}: ${detail}`);
     wrapped.name = 'SandboxInitializationError';
@@ -211,6 +255,16 @@ function appendRuntimeBackedEtcFiles(args) {
         args.push('--ro-bind', candidate, resolved);
     }
 }
+function appendContainerEtcFileBinds(args) {
+    for (const candidate of ['/etc/resolv.conf', '/etc/hosts', '/etc/hostname']) {
+        if (!fs.existsSync(candidate))
+            continue;
+        // A directory bind does not recursively preserve OCI/container-runtime
+        // file mounts. Rebind only the three standard runtime-injected files after
+        // /etc becomes readonly; no other /etc mount is carried into the guard.
+        args.push('--ro-bind', candidate, candidate);
+    }
+}
 function appendHClassMasks(args, root, maskContainerSockets) {
     for (const target of getExistingHClassMaskTargets(root)) {
         if (target.kind === 'directory')
@@ -251,20 +305,30 @@ export function buildHClassGuardCommand(executable, executableArgs, root = resol
             throw new Error(`Codex managed requirements is not a file: ${requirements}`);
         }
         const managedDirectory = path.dirname(requirements);
+        const systemConfigDirectory = '/etc/codex';
+        let systemConfigStat;
+        try {
+            systemConfigStat = fs.lstatSync(systemConfigDirectory);
+        }
+        catch {
+            throw new Error(`Codex managed requirements mountpoint is unavailable: ${systemConfigDirectory} `
+                + 'must be created as a real directory during installation');
+        }
+        if (!systemConfigStat.isDirectory() || systemConfigStat.isSymbolicLink()) {
+            throw new Error(`Codex managed requirements mountpoint is unsafe: ${systemConfigDirectory} `
+                + 'must be a real directory');
+        }
         // Keep the copied hook immutable even when a session uses bypass mode.
         args.push('--ro-bind', managedDirectory, managedDirectory);
-        // A host may not have /etc/codex yet. Overlay /etc inside this namespace so
-        // Bubblewrap can create the mountpoint without modifying the host, while
-        // retaining the complete host /etc as the read-only lower layer.
-        args.push('--overlay-src', '/etc');
-        args.push('--tmp-overlay', '/etc');
-        args.push('--dir', '/etc/codex');
-        // Replace the complete Codex system-config directory inside this app-server
-        // namespace so host system hooks cannot join EvolCore's managed hook set.
-        args.push('--tmpfs', '/etc/codex');
-        args.push('--ro-bind', requirements, '/etc/codex/requirements.toml');
-        args.push('--remount-ro', '/etc/codex');
-        args.push('--remount-ro', '/etc');
+        // The guard starts from a writable root so owner-bypass workspaces keep
+        // their normal semantics. Make the system configuration tree readonly
+        // before replacing only Codex's directory, so a root daemon cannot write
+        // unrelated files under /etc from inside this namespace.
+        args.push('--ro-bind', '/etc', '/etc');
+        appendContainerEtcFileBinds(args);
+        // Replace only Codex's system-config directory. Requiring the mountpoint to
+        // exist prevents Bubblewrap from creating it on the writable host root.
+        args.push('--ro-bind', managedDirectory, systemConfigDirectory);
     }
     args.push('--', executable, ...executableArgs);
     return { command: bubblewrapPath, args };
@@ -304,4 +368,6 @@ export function buildBubblewrapCommand(executable, executableArgs, options) {
 }
 export function _resetSandboxRuntimeCache() {
     cachedBubblewrapPath = undefined;
+    sandboxInitializationCircuit = undefined;
+    sandboxCircuitNoticeAt = 0;
 }

package/dist/core/permission/tool-policy.js

@@ -4,7 +4,7 @@ import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
 import { containsHClassReference, containsLClassReference, checkProtectedPathAccess, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, resolveProtectedCandidateWithoutFinalSymlink, } from '../protected-paths.js';
-import { classifyEvolcoreShellCommand, parseCodexToolCommandArgv, parseBoundedOutputShellCommand, parseLiteralShellArgv, unwrapCodexShellCommandArgv, } from './ec-command-parser.js';
+import { classifyEvolcoreShellCommand, parseCodexToolCommandArgv, parseBoundedOutputShellCommand, parseLiteralShellArgv, resolveCodexShellCarrierArgv, } from './ec-command-parser.js';
 import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
 /** Resolve the session-owned temporary root supplied by the execution host. */
 export function resolveManagedTempDir(env = process.env) {
@@ -1148,7 +1148,7 @@ export function checkLClassWrite(toolName, input, context) {
                 behavior: 'deny',
                 message: context?.permissionMode === 'readonly'
                     ? '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径'
-                    : '🔒 L-class 路径仅允许受限、可证明只读的命令；未知 Shell 语法失败关闭。修改必须通过受控的 EvolCore 命令',
+                    : '🔒 L-class 路径允许读取，但当前 Bash 复合命令无法证明为只读，已拒绝执行。请改用受控的 EvolCore 读取命令或白名单只读命令',
             };
         }
         collectFilesystemWriteGrantPaths(input.additionalPermissions, writeGrantPaths, projectRootWriteSubpaths);
@@ -1352,7 +1352,8 @@ export function evaluateToolPreflight(toolName, input, context) {
             ? input.commandArgv
             : undefined;
         const outerArgv = explicitCommandArgv ?? parseLiteralShellArgv(command) ?? undefined;
-        const wrappedCommand = outerArgv ? unwrapCodexShellCommandArgv(outerArgv) : undefined;
+        const shellCarrier = outerArgv ? resolveCodexShellCarrierArgv(outerArgv) : undefined;
+        const wrappedCommand = shellCarrier?.command;
         const policyCommand = wrappedCommand ?? command;
         if (context.sessionId && /^\s*(?:command\s+-v|which|type)\s+ec\s*$/i.test(policyCommand)) {
             return {
@@ -1397,7 +1398,9 @@ export function evaluateToolPreflight(toolName, input, context) {
                 policyCode: 'managed_ec_aid_scope_forbidden',
             };
         }
-        const ecCommand = classifyEvolcoreShellCommand(policyCommand);
+        const ecCommand = classifyEvolcoreShellCommand(policyCommand, shellCarrier
+            ? { dialect: shellCarrier.dialect }
+            : {});
         if (ecCommand.kind === 'literal') {
             return { behavior: 'allow', input, reason: 'ec-command' };
         }
@@ -1406,25 +1409,34 @@ export function evaluateToolPreflight(toolName, input, context) {
         }
         if (ecCommand.kind === 'composite') {
             if (ecCommand.issue === 'unsafe-expansion') {
+                const message = shellCarrier?.dialect === 'powershell'
+                    ? '🔒 EC 双引号正文包含未转义的 PowerShell 展开；纯文字请优先使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。PowerShell 传给 ec 时会还原为原文字面量'
+                    : '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量';
                 return {
                     behavior: 'deny',
                     input,
-                    message: '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量',
+                    message,
                     policyCode: 'ec_shell_unsafe_expansion',
                 };
             }
             if (ecCommand.issue === 'invalid-quote') {
+                const message = shellCarrier?.dialect === 'powershell'
+                    ? '🔒 EC 命令引号未闭合或存在错误嵌套；PowerShell 正文内的双引号请用反引号转义，或改用单引号包裹纯文字'
+                    : '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"';
                 return {
                     behavior: 'deny',
                     input,
-                    message: '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"',
+                    message,
                     policyCode: 'ec_shell_invalid_quote',
                 };
             }
+            const message = shellCarrier?.dialect === 'powershell'
+                ? '🔒 EC 命令调用被拒绝：一次 PowerShell/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要拼接探测命令，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开或子表达式追加其它命令。'
+                : '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。';
             return {
                 behavior: 'deny',
                 input,
-                message: '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。',
+                message,
                 policyCode: 'ec_shell_composite_command',
             };
         }