evolcore 0.0.18 → 0.0.20

package/dist/core/bootstrap-service.js

@@ -5,7 +5,7 @@ import { kitsTemplatesDir, agentMdPath } from '../paths.js';
 import { resolveAgentDisplayName } from '../aun/aid/agentmd.js';
 import { logger } from '../utils/logger.js';
 import { loadAgent, saveAgent } from '../config-store.js';
-import { normalizeAgentLifecycle, withLifecycleForWrite } from '../config/lifecycle.js';
+import { resolveAgentLifecycle, withLifecycleForWrite } from '../config/lifecycle.js';
 import { renderTemplate } from '../eck/manifest-engine.js';
 import { activeBaseagent } from './model/config-scope.js';
 import { buildEnvelope } from './message/message-utils.js';
@@ -123,12 +123,18 @@ export class BootstrapService {
             this.inFlight.delete(key);
             return false;
         }
-        const config = normalizeAgentLifecycle(loadedConfig);
-        if (config.lifecycle === 'active') {
+        const lifecycle = resolveAgentLifecycle(loadedConfig);
+        if (lifecycle === 'active') {
             this.inFlight.delete(key);
             return false;
         }
-        const starting = config.lifecycle === 'created';
+        if (lifecycle !== 'created' && lifecycle !== 'bootstrapping') {
+            this.inFlight.delete(key);
+            logger.warn(`[Bootstrap] Refusing invalid lifecycle for ${aid}: ${String(loadedConfig.lifecycle)}`);
+            return false;
+        }
+        const config = { ...loadedConfig, lifecycle };
+        const starting = lifecycle === 'created';
         const channelType = ctx.channelType || this.channelTypeFromKey(ctx.channelKey);
         const configuredRecipient = this.resolveConfiguredRecipient(config, ctx.channelKey, channelType);
         const recipientId = ctx.recipientId || configuredRecipient;
@@ -140,35 +146,14 @@ export class BootstrapService {
             this.inFlight.delete(key);
             return false;
         }
-        // The bootstrap prompt is deliberately a private message to the configured
-        // owner. An inbound owner message may have arrived from a group, in which
-        // case ctx.channelId is the group AID and must not be paired with the
-        // private delivery route below (that would call message.send(to=group)).
-        // A configured AUN recipient may itself be a group AID. Ask the channel's
-        // authoritative group endpoint before choosing the transport; never infer
-        // group/private semantics from the AID string or from the inbound venue.
-        let isGroupRecipient = false;
-        try {
-            isGroupRecipient = channelType === 'aun'
-                ? (await ctx.adapter.isGroup?.(recipientId)) === true
-                : false;
-        }
-        catch (error) {
-            // Group/private routing is security-sensitive. If the authoritative
-            // probe fails, do not guess a route, and release the single-flight key
-            // so a later connection or retry can recover.
-            this.inFlight.delete(key);
-            logger.warn(`[Bootstrap] Failed to resolve recipient type for ${aid}: ${error instanceof Error ? error.message : String(error)}`);
-            return false;
-        }
-        const delivery = isGroupRecipient === true
-            ? { chatType: 'group', groupId: recipientId }
-            : { chatType: 'private' };
-        const channelId = delivery.chatType === 'group'
-            ? delivery.groupId
-            : channelType === 'aun'
-                ? recipientId
-                : ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
+        // Bootstrap is initiated by connection/owner binding, not by a reply to
+        // an existing group message. `owners[]` contains personal Owner AIDs, so
+        // the first prompt must always use the private message route. Inbound
+        // group context must never change this initial delivery target.
+        const delivery = { chatType: 'private' };
+        const channelId = channelType === 'aun'
+            ? recipientId
+            : ctx.channelId || this.defaultChannelIdForConnection(channelType, recipientId);
         if (!channelId) {
             this.inFlight.delete(key);
             return false;
@@ -234,14 +219,14 @@ export class BootstrapService {
         const loadedConfig = loadAgent(aid) || agent?.config;
         if (!loadedConfig)
             return { ok: false, error: `Agent "${aid}" not found` };
-        const lifecycle = normalizeAgentLifecycle(loadedConfig).lifecycle;
+        const lifecycle = resolveAgentLifecycle(loadedConfig);
         if (lifecycle === 'active')
             return { ok: true, aid, transitioned: false };
         if (lifecycle !== 'bootstrapping') {
             return {
                 ok: false,
                 code: 'INVALID_LIFECYCLE',
-                error: `Agent "${aid}" is ${lifecycle}; only a bootstrapping agent can become ready`,
+                error: `Agent "${aid}" is ${lifecycle ?? `invalid (${String(loadedConfig.lifecycle)})`}; only a bootstrapping agent can become ready`,
             };
         }
         this.setLifecycle(agent, aid, 'active');
@@ -253,7 +238,7 @@ export class BootstrapService {
         const agent = this.agentRegistry.get(aid);
         const loadedConfig = loadAgent(aid) || agent?.config;
         return loadedConfig
-            ? normalizeAgentLifecycle(loadedConfig).lifecycle
+            ? resolveAgentLifecycle(loadedConfig)
             : null;
     }
     setLifecycle(agent, aid, lifecycle) {

package/dist/core/channel-loader.js

@@ -65,7 +65,6 @@ export class ChannelLoader {
             owner: agent.getOwner(aunEffName),
             enabled: true,
             keystorePath: agent.config.aun?.keystorePath,
-            gatewayUrl: agent.config.aun?.gatewayUrl,
         };
         const configInsts = [aunInst];
         for (const inst of agent.config.channels) {
@@ -255,7 +254,6 @@ export function buildReloadHooks(deps) {
                     aid,
                     enabled: true,
                     keystorePath: agent.config?.aun?.keystorePath,
-                    gatewayUrl: agent.config?.aun?.gatewayUrl,
                 }
                 : (() => {
                     const agentChannels = agent.config?.channels ?? [];

package/dist/core/data-migration.js

@@ -1295,8 +1295,14 @@ function finalizationSourcePaths(root, manifest) {
 function archiveHash(filePath) {
     return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
 }
-function verifyArchiveContains(archivePath, sourcePaths) {
-    const tar = process.platform === 'win32' ? 'tar.exe' : 'tar';
+function systemTar() {
+    if (process.platform !== 'win32')
+        return 'tar';
+    // Git Bash puts GNU tar ahead of Windows bsdtar on PATH. GNU tar treats the
+    // drive colon in an absolute archive path as host:path remote syntax.
+    return path.win32.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe');
+}
+function verifyArchiveContains(archivePath, sourcePaths, tar) {
     const normalizeArchivePath = (value) => value
         .trim()
         .replace(/\\/g, '/')
@@ -1402,14 +1408,14 @@ export function finalizeDataMigration(root, manifest) {
     }
     fs.mkdirSync(path.dirname(archivePath), { recursive: true });
     const temporary = `${archivePath}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`;
-    const tar = process.platform === 'win32' ? 'tar.exe' : 'tar';
+    const tar = systemTar();
     try {
         execFileSync(tar, ['-czf', temporary, ...sourcePaths], {
             cwd: root,
             stdio: 'pipe',
             windowsHide: process.platform === 'win32',
         });
-        verifyArchiveContains(temporary, sourcePaths);
+        verifyArchiveContains(temporary, sourcePaths, tar);
         fs.renameSync(temporary, archivePath);
     }
     catch (error) {

package/dist/core/evolagent.js

@@ -243,16 +243,17 @@ export class EvolAgent {
                 b.mentionMode = value;
         });
     }
-    /** 读取观察者模式开关（默认 false）。 */
+    /** 读取观察者模式开关（默认 true；显式 false 可关闭）。 */
     getObservable() {
-        return this.merged.observable === true;
+        return this.merged.observable ?? true;
     }
     /** 设置观察者模式开关：开启后入站/出站消息各转发一份给 owners[]。 */
     setObservable(value) {
+        // The default is enabled, so false must remain an explicit persisted override.
         if (value)
-            this.rawAgent.observable = true;
-        else
             delete this.rawAgent.observable;
+        else
+            this.rawAgent.observable = false;
         this.merged.observable = value;
         this.persist();
     }

package/dist/core/message/message-bridge.js

@@ -695,12 +695,6 @@ export class MessageBridge {
                 const channelKey = adapter?.channelKey || channelName;
                 const owningAgent = this.agentRegistry?.resolveByChannel(channelKey)
                     ?? this.agentRegistry?.resolveByChannel(channelName);
-                // Agent-owned business controls bypass ResponseEngine entirely, so
-                // expose them only after bootstrap has explicitly reached active.
-                // Missing lifecycle fails closed; control channels without an owning
-                // EvolAgent keep their existing command behavior.
-                const allowsNormalCommandRouting = !owningAgent
-                    || owningAgent.config?.lifecycle === 'active';
                 const parsedChannelKey = tryParseChannelKey(channelKey);
                 const chatType = msg.chatType || 'private';
                 const delivery = chatType === 'group'
@@ -779,7 +773,10 @@ export class MessageBridge {
                     logger.info(`[MessageBridge] Inbound admission denied before business routing: self=${selfAid} actor=${actorId ?? '<none>'} channel=${channelKey} reason=${admissionDecision.reason}`);
                     return;
                 }
-                const menuControl = allowsNormalCommandRouting && resolvedChannelType === 'aun'
+                // Menu is a protocol control plane. Its parsing and response path must
+                // remain available throughout the agent lifecycle; lifecycle gates
+                // ordinary model execution, not protocol handling.
+                const menuControl = resolvedChannelType === 'aun'
                     ? parseMenuControl(content)
                     : { isMenu: false };
                 let menuResponseWarning;
@@ -930,8 +927,7 @@ export class MessageBridge {
                 // 2. 命令快速路径（去除引用前缀后检查，兼容话题中引用上文的情况）
                 const contentForCmd = content.replace(/^(>[^\n]*\n)+\n?/, '').trim();
                 const cmdContent = contentForCmd || content;
-                const isCmd = allowsNormalCommandRouting
-                    && msg.source !== 'handoff'
+                const isCmd = msg.source !== 'handoff'
                     && this.cmdHandler.isCommand(cmdContent);
                 if (isCmd) {
                     logger.debug(`[MessageBridge] Command detected: "${cmdContent}", routing to handler`);
@@ -969,8 +965,7 @@ export class MessageBridge {
                         logger.debug(`[MessageBridge] Failed to log inbound command: ${e}`);
                     }
                 }
-                if (allowsNormalCommandRouting
-                    && msg.source !== 'handoff'
+                if (msg.source !== 'handoff'
                     && await this.handleCommand(cmdContent, channelName, msg.channelId, (text) => {
                         const taskId = `cmd-${msg.messageId || Date.now()}`;
                         logger.channelOut({ channel: channelName, channelId: msg.channelId, taskId, correlationId: taskId, sessionId: msg.replyContext?.sessionId, agentAid: msg.selfAID, payload: { kind: 'command.result', text } });

package/dist/core/message/response-engine.js

@@ -33,6 +33,7 @@ import { eligibleFallbackModels } from '../model/model-fallback.js';
 import { RetryScheduler } from './retry-scheduler.js';
 import { constrainRuntimePermissionMode, resolveRuntimeStringField } from '../role/runtime-policy.js';
 import { resolveEffective, resolveEffectiveFieldWithSource } from '../../config/config-manager.js';
+import { resolveAgentLifecycle } from '../../config/lifecycle.js';
 import { authorizationConfigRevision, checkRoleAccess, getFirstStaticAgentOwner, listStaticAgentAdmins, listStaticAgentOwners, resolvePeerRoleDetail, roleToSessionIdentity, } from '../../config/peer-role-resolver.js';
 import { insertUsageEvent, insertContextBreakdown, insertModelCalls } from '../../stats/writer.js';
 import { normalizeUsage } from '../../stats/normalizer.js';
@@ -48,7 +49,58 @@ import { SessionTurnCoordinator } from '../session/session-turn-coordinator.js';
 import { recordTriggerExecutionAnomaly } from '../../trigger/anomaly-store.js';
 import { classifyToolErrorCode } from '../permission/tool-error-code.js';
 import { buildToolLifecycleEventKey } from '../audit/event-key.js';
-import { PauseController } from './pause-controller.js';
+export class PauseController {
+    state = 'running';
+    waiters = new Set();
+    requestPause() {
+        if (this.state !== 'running')
+            return false;
+        this.state = 'pause_requested';
+        return true;
+    }
+    isPauseRequested() { return this.state === 'pause_requested'; }
+    isPaused() { return this.state === 'paused'; }
+    waitAtToolBoundary(signal) {
+        if (signal?.aborted)
+            return Promise.resolve('cancelled');
+        if (this.state === 'running')
+            return Promise.resolve('none');
+        this.state = 'paused';
+        return new Promise(resolve => {
+            const waiter = { resolve: () => { }, abort: undefined };
+            const finish = (result) => {
+                this.waiters.delete(waiter);
+                if (waiter.abort)
+                    signal?.removeEventListener('abort', waiter.abort);
+                resolve(result);
+            };
+            waiter.resolve = finish;
+            if (signal) {
+                waiter.abort = () => finish('cancelled');
+                signal.addEventListener('abort', waiter.abort, { once: true });
+            }
+            this.waiters.add(waiter);
+            if (this.state === 'running')
+                finish('released');
+            else if (signal?.aborted)
+                finish('cancelled');
+        });
+    }
+    resume() {
+        if (this.state === 'running')
+            return false;
+        this.state = 'running';
+        for (const waiter of [...this.waiters])
+            waiter.resolve('released');
+        return true;
+    }
+    cancel() {
+        this.state = 'running';
+        for (const waiter of [...this.waiters])
+            waiter.resolve('cancelled');
+    }
+    clear() { this.cancel(); }
+}
 function isShowActivitiesMode(value) {
     return value === 'all' || value === 'text' || value === 'none';
 }
@@ -1555,7 +1607,9 @@ export class ResponseEngine {
         const owningAgentForTask = this.agentRegistry?.resolveByChannel(channelKey)
             ?? (taskAgentAid ? this.agentRegistry?.get(taskAgentAid) : null);
         const runnerSelfAid = owningAgentForTask?.aid || session.selfAID || message.selfAID;
-        const lifecycle = owningAgentForTask?.config?.lifecycle;
+        const lifecycle = owningAgentForTask
+            ? resolveAgentLifecycle(owningAgentForTask.config)
+            : undefined;
         const isActive = lifecycle === 'active';
         const isBootstrapping = lifecycle === 'bootstrapping';
         // Per-method agent name for stats bucketing (agent.name or '<unknown>')
@@ -1566,10 +1620,12 @@ export class ResponseEngine {
             return;
         }
         // Agent-owned turns are runnable only in the two explicit execution
-        // states. An untransitioned `created` agent or a malformed/missing
-        // lifecycle must not fall through to a base runner's default prompt.
+        // states. An untransitioned `created` agent or malformed lifecycle must
+        // not fall through to a base runner's default prompt. Missing lifecycle
+        // is normalized to active for legacy configurations.
         if (owningAgentForTask && !isActive && !isBootstrapping) {
-            const blockedLifecycle = lifecycle ?? 'missing';
+            const blockedLifecycle = lifecycle
+                ?? `invalid (${String(owningAgentForTask.config.lifecycle)})`;
             logger.error(`[ResponseEngine] Agent lifecycle is not runnable: agent=${owningAgentForTask.aid} lifecycle=${blockedLifecycle}`);
             this.publishTriggerExecutionFailure(message, `agent_lifecycle_not_runnable:${blockedLifecycle}`);
             return;
@@ -1577,7 +1633,7 @@ export class ResponseEngine {
         // 二次拦截：如果命令消息绕过 MessageBridge 的 handleCommand 泄漏到这里，
         // 静默丢弃而不是发送给 Agent（命令已在 MessageBridge 层处理过）
         const rawContent = message.content.replace(/^(>[^\n]*\n)+\n?/, '').trim();
-        if (!isBootstrapping && rawContent.startsWith('/') && this.isKnownCommand(rawContent)) {
+        if (rawContent.startsWith('/') && this.isKnownCommand(rawContent)) {
             logger.warn(`[ResponseEngine] Command leaked past MessageBridge, dropped: "${rawContent.substring(0, 40)}"`);
             this.publishTriggerExecutionFailure(message, 'trigger_command_not_supported');
             return;

package/dist/core/permission/ec-command-parser.js

@@ -1,16 +1,73 @@
 const HEAD_EXECUTABLES = new Set(['head', '/bin/head', '/usr/bin/head']);
 // Codex app-server sends command executions through a fixed shell carrier.
 // Treat the carrier as syntax only after parsing it as literal argv; never
-// accept an arbitrary `sh -c` string or unwrap shell composition here.
-const CODEX_SHELL_EXECUTABLES = new Set([
+// accept an arbitrary shell command string or unwrap composition here.
+const CODEX_POSIX_SHELL_EXECUTABLES = new Set([
     'bash', '/bin/bash', '/usr/bin/bash',
     'sh', '/bin/sh', '/usr/bin/sh',
 ]);
+const CODEX_POWERSHELL_EXECUTABLES = new Set([
+    'pwsh', 'pwsh.exe', 'powershell', 'powershell.exe',
+]);
+const CODEX_POWERSHELL_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Program Files[\\/]PowerShell[\\/][0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9.-]+)?[\\/]pwsh\.exe|Windows[\\/]System32[\\/]WindowsPowerShell[\\/]v1\.0[\\/]powershell\.exe)$/i;
 const SHELL_UNQUOTED_META = new Set([
     ';', '&', '|', '`', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#',
 ]);
+const POWERSHELL_UNQUOTED_META = new Set([
+    ';', '&', '|', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#', '@',
+]);
 const AMBIGUOUS_FILE_PATH_RE = /[\0\r\n$`*?\[\]{}<>|;&]/;
-const EVOLCORE_COMMAND_POSITION_RE = /(?:^|[;&|()`])\s*ec(?=\s|[;&|()<>`]|$)/i;
+// This is intentionally limited to the command boundary. It is not a search
+// for `ec` anywhere in the input: quoted arguments, regexps and log text must
+// never establish an EC invocation.
+function hasEcCommandPrefix(command) {
+    let quote = null;
+    let escaped = false;
+    let boundary = true;
+    for (let index = 0; index < command.length; index++) {
+        const char = command[index];
+        if (escaped) {
+            escaped = false;
+            boundary = false;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '\\') {
+                escaped = true;
+                continue;
+            }
+            if (char === '"')
+                quote = null;
+            continue;
+        }
+        if (char === "'") {
+            quote = 'single';
+            boundary = false;
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            boundary = false;
+            continue;
+        }
+        if (/[;&|`()<>]/.test(char)) {
+            boundary = true;
+            continue;
+        }
+        if (boundary && /\s/.test(char))
+            continue;
+        if (boundary && command.slice(index, index + 2).toLowerCase() === 'ec'
+            && (index + 2 === command.length || /\s|[;&|`()<>]/.test(command[index + 2])))
+            return true;
+        boundary = false;
+    }
+    return false;
+}
 function trimShellSpacing(value) {
     return value.replace(/^[ \t]+|[ \t]+$/g, '');
 }
@@ -83,6 +140,106 @@ function isLiteralArgBoundary(value) {
 function isShellParameterExpansionStart(value) {
     return value === '(' || value === '{' || !!value && /[A-Za-z0-9_@*#?$!\-]/.test(value);
 }
+function parseLiteralPowerShellCommand(command) {
+    const input = trimShellSpacing(command);
+    if (!input)
+        return { ok: false, issue: 'empty-command' };
+    if (input.includes('\0'))
+        return { ok: false, issue: 'invalid-control-char' };
+    const argv = [];
+    let token = '';
+    let tokenStarted = false;
+    let quote = null;
+    const finishToken = () => {
+        if (!tokenStarted)
+            return;
+        argv.push(token);
+        token = '';
+        tokenStarted = false;
+    };
+    for (let index = 0; index < input.length; index++) {
+        const char = input[index];
+        if (quote === 'single') {
+            if (char === "'" && input[index + 1] === "'") {
+                token += "'";
+                index++;
+            }
+            else if (char === "'") {
+                if (!isLiteralArgBoundary(input[index + 1]))
+                    return { ok: false, issue: 'invalid-quote' };
+                quote = null;
+            }
+            else {
+                token += char;
+            }
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '"') {
+                if (!isLiteralArgBoundary(input[index + 1]))
+                    return { ok: false, issue: 'invalid-quote' };
+                quote = null;
+                continue;
+            }
+            if (char === '`') {
+                const next = input[++index];
+                if (next === undefined)
+                    return { ok: false, issue: 'invalid-quote' };
+                if (next === '\r' || next === '\n')
+                    return { ok: false, issue: 'structural-newline' };
+                token += next;
+                continue;
+            }
+            if (char === '$' && isShellParameterExpansionStart(input[index + 1])) {
+                return { ok: false, issue: 'unsafe-expansion' };
+            }
+            token += char;
+            continue;
+        }
+        if (char === ' ' || char === '\t') {
+            finishToken();
+            continue;
+        }
+        if (char === '\r' || char === '\n')
+            return { ok: false, issue: 'structural-newline' };
+        if (/\s/u.test(char) || char.charCodeAt(0) < 0x20 || char === '\x7f') {
+            return { ok: false, issue: 'invalid-control-char' };
+        }
+        if (char === "'") {
+            tokenStarted = true;
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            tokenStarted = true;
+            quote = 'double';
+            continue;
+        }
+        if (char === '`') {
+            const next = input[++index];
+            if (next === undefined)
+                return { ok: false, issue: 'invalid-quote' };
+            if (next === '\r' || next === '\n')
+                return { ok: false, issue: 'structural-newline' };
+            tokenStarted = true;
+            token += next;
+            continue;
+        }
+        const isWordInitialMeta = (char === '#' || char === '@') && !tokenStarted;
+        const isAlwaysMeta = POWERSHELL_UNQUOTED_META.has(char) && char !== '#' && char !== '@';
+        if (isAlwaysMeta || isWordInitialMeta || (char === '~' && !tokenStarted)) {
+            return { ok: false, issue: 'shell-composition' };
+        }
+        tokenStarted = true;
+        token += char;
+    }
+    if (quote)
+        return { ok: false, issue: 'invalid-quote' };
+    finishToken();
+    return argv.length > 0
+        ? { ok: true, argv }
+        : { ok: false, issue: 'empty-command' };
+}
 function doubleQuotedIssueAt(input, index) {
     const char = input[index];
     if (char === '`' || (char === '$' && isShellParameterExpansionStart(input[index + 1]))) {
@@ -102,6 +259,9 @@ function doubleQuotedIssueAt(input, index) {
  * Anything outside this subset is never granted the privileged EC path.
  */
 export function parseLiteralShellCommand(command, options = {}) {
+    if (options.dialect === 'powershell') {
+        return parseLiteralPowerShellCommand(command);
+    }
     const input = trimShellSpacing(options.allowManagedTmpDir
         ? substituteManagedTmpDirToken(command)
         : command);
@@ -209,15 +369,21 @@ export function parseLiteralShellArgv(command, options = {}) {
     const result = parseLiteralShellCommand(command, options);
     return result.ok ? result.argv : null;
 }
-/**
- * Return the command string carried by Codex's literal `/bin/bash -lc ...`
- * wrapper. The wrapper is accepted only in its exact three-argv form and the
- * caller must parse the returned string with the literal shell parser again.
- */
-export function unwrapCodexShellCommandArgv(argv) {
-    if (argv.length !== 3 || argv[1] !== '-lc')
+export function resolveCodexShellCarrierArgv(argv) {
+    if (argv.length !== 3)
         return undefined;
-    return CODEX_SHELL_EXECUTABLES.has(argv[0]) ? argv[2] : undefined;
+    if (argv[1] === '-lc' && CODEX_POSIX_SHELL_EXECUTABLES.has(argv[0])) {
+        return { command: argv[2], dialect: 'posix' };
+    }
+    const powershellExecutable = argv[0].toLowerCase();
+    const isPowerShell = CODEX_POWERSHELL_EXECUTABLES.has(powershellExecutable)
+        || CODEX_POWERSHELL_INSTALL_PATH_RE.test(argv[0]);
+    return isPowerShell && argv[1].toLowerCase() === '-command'
+        ? { command: argv[2], dialect: 'powershell' }
+        : undefined;
+}
+export function unwrapCodexShellCommandArgv(argv) {
+    return resolveCodexShellCarrierArgv(argv)?.command;
 }
 /**
  * Parse either a bare literal command or the exact shell carrier emitted by
@@ -228,8 +394,10 @@ export function parseCodexShellCommandArgv(command, options = {}) {
     const outer = parseLiteralShellArgv(command, options);
     if (!outer)
         return null;
-    const wrapped = unwrapCodexShellCommandArgv(outer);
-    return wrapped === undefined ? outer : parseLiteralShellArgv(wrapped, options);
+    const carrier = resolveCodexShellCarrierArgv(outer);
+    return carrier === undefined
+        ? outer
+        : parseLiteralShellArgv(carrier.command, { ...options, dialect: carrier.dialect });
 }
 /**
  * Resolve a Codex command input while preserving the raw `commandArgv` form
@@ -239,10 +407,13 @@ export function parseCodexShellCommandArgv(command, options = {}) {
 export function parseCodexToolCommandArgv(input) {
     if (Array.isArray(input.commandArgv) && input.commandArgv.every(value => typeof value === 'string')) {
         const outer = input.commandArgv;
-        const wrapped = unwrapCodexShellCommandArgv(outer);
-        return wrapped === undefined
+        const carrier = resolveCodexShellCarrierArgv(outer);
+        return carrier === undefined
             ? outer
-            : parseLiteralShellArgv(wrapped, { allowManagedTmpDir: true });
+            : parseLiteralShellArgv(carrier.command, {
+                allowManagedTmpDir: true,
+                dialect: carrier.dialect,
+            });
     }
     const command = typeof input.command === 'string' ? input.command : '';
     return parseCodexShellCommandArgv(command, { allowManagedTmpDir: true });
@@ -924,28 +1095,36 @@ export function parseBoundedOutputShellCommand(command) {
  * policy must not interpret EC subcommands or arguments: a single literal
  * invocation may leave the sandbox, while shell composition may not.
  */
-export function classifyEvolcoreShellCommand(command) {
-    const parseOptions = { allowManagedTmpDir: true };
+export function classifyEvolcoreShellCommand(command, options = {}) {
+    const parseOptions = { allowManagedTmpDir: true, ...options };
     const literal = parseLiteralShellCommand(command, parseOptions);
     if (literal.ok) {
         if (literal.argv[0] === 'ec')
             return { kind: 'literal' };
-        const wrapped = unwrapCodexShellCommandArgv(literal.argv);
-        if (wrapped !== undefined) {
-            const nested = parseLiteralShellCommand(wrapped, parseOptions);
+        const carrier = resolveCodexShellCarrierArgv(literal.argv);
+        if (carrier !== undefined) {
+            const nested = parseLiteralShellCommand(carrier.command, {
+                ...parseOptions,
+                dialect: carrier.dialect,
+            });
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
-            if (!nested.ok && EVOLCORE_COMMAND_POSITION_RE.test(wrapped)) {
+            if (!nested.ok && hasEcCommandPrefix(carrier.command)) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
         return { kind: 'none' };
     }
-    const boundedOutput = parseBoundedOutputShellCommand(command);
+    const boundedOutput = options.dialect === 'powershell'
+        ? null
+        : parseBoundedOutputShellCommand(command);
     if (boundedOutput && boundedOutput.argv[0] === 'ec') {
         return { kind: 'bounded-output', command: boundedOutput };
     }
-    return EVOLCORE_COMMAND_POSITION_RE.test(command)
+    // Only a command-boundary prefix is enough to preserve a useful syntax
+    // error for a malformed direct EC invocation. Never scan for EC tokens in
+    // arbitrary raw text after parsing fails.
+    return hasEcCommandPrefix(command)
         ? { kind: 'composite', issue: literal.issue }
         : { kind: 'none' };
 }