evolcore 0.0.18 → 0.0.20

package/dist/core/permission/sandbox-runtime.js

@@ -285,6 +285,48 @@ function appendLClassReadOnlyBinds(args, root) {
         args.push('--ro-bind', target.path, target.path);
     }
 }
+export function ensureCodexManagedMountpoint(systemConfigDirectory = '/etc/codex', effectiveUid = typeof process.getuid === 'function' ? process.getuid() : undefined) {
+    let systemConfigStat;
+    try {
+        systemConfigStat = fs.lstatSync(systemConfigDirectory);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw new Error(`Codex managed requirements mountpoint is unavailable: ${systemConfigDirectory} `
+                + `could not be inspected (${error instanceof Error ? error.message : String(error)})`);
+        }
+    }
+    if (!systemConfigStat && process.platform === 'linux' && effectiveUid === 0) {
+        let created = false;
+        try {
+            fs.mkdirSync(systemConfigDirectory, { mode: 0o755 });
+            created = true;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST') {
+                throw new Error(`Codex managed requirements mountpoint is unavailable: ${systemConfigDirectory} `
+                    + `could not be created by the root daemon (${error instanceof Error ? error.message : String(error)})`);
+            }
+        }
+        if (created)
+            fs.chmodSync(systemConfigDirectory, 0o755);
+        try {
+            systemConfigStat = fs.lstatSync(systemConfigDirectory);
+        }
+        catch (error) {
+            throw new Error(`Codex managed requirements mountpoint is unavailable: ${systemConfigDirectory} `
+                + `could not be verified after creation (${error instanceof Error ? error.message : String(error)})`);
+        }
+    }
+    if (!systemConfigStat) {
+        throw new Error(`Codex managed requirements mountpoint is unavailable: ${systemConfigDirectory} `
+            + 'must be created as a real directory during installation; run: sudo install -d -m 0755 /etc/codex');
+    }
+    if (!systemConfigStat.isDirectory() || systemConfigStat.isSymbolicLink()) {
+        throw new Error(`Codex managed requirements mountpoint is unsafe: ${systemConfigDirectory} `
+            + 'must be a real directory');
+    }
+}
 export function buildHClassGuardCommand(executable, executableArgs, root = resolveRoot(), options = {}) {
     const bubblewrapPath = resolveBubblewrapPath();
     if (!bubblewrapPath)
@@ -306,18 +348,10 @@ export function buildHClassGuardCommand(executable, executableArgs, root = resol
         }
         const managedDirectory = path.dirname(requirements);
         const systemConfigDirectory = '/etc/codex';
-        let systemConfigStat;
-        try {
-            systemConfigStat = fs.lstatSync(systemConfigDirectory);
-        }
-        catch {
-            throw new Error(`Codex managed requirements mountpoint is unavailable: ${systemConfigDirectory} `
-                + 'must be created as a real directory during installation');
-        }
-        if (!systemConfigStat.isDirectory() || systemConfigStat.isSymbolicLink()) {
-            throw new Error(`Codex managed requirements mountpoint is unsafe: ${systemConfigDirectory} `
-                + 'must be a real directory');
-        }
+        // The npm lifecycle and public installer provision this path. Root-owned
+        // legacy daemons may repair only the missing-directory case; unsafe path
+        // types and unprivileged processes remain fail-closed.
+        ensureCodexManagedMountpoint(systemConfigDirectory);
         // Keep the copied hook immutable even when a session uses bypass mode.
         args.push('--ro-bind', managedDirectory, managedDirectory);
         // The guard starts from a writable root so owner-bypass workspaces keep

package/dist/core/permission/tool-policy.js

@@ -4,7 +4,7 @@ import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
 import { containsHClassReference, containsLClassReference, checkProtectedPathAccess, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, resolveProtectedCandidateWithoutFinalSymlink, } from '../protected-paths.js';
-import { classifyEvolcoreShellCommand, parseCodexToolCommandArgv, parseBoundedOutputShellCommand, parseLiteralShellArgv, unwrapCodexShellCommandArgv, } from './ec-command-parser.js';
+import { classifyEvolcoreShellCommand, parseCodexToolCommandArgv, parseBoundedOutputShellCommand, parseLiteralShellArgv, resolveCodexShellCarrierArgv, } from './ec-command-parser.js';
 import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
 /** Resolve the session-owned temporary root supplied by the execution host. */
 export function resolveManagedTempDir(env = process.env) {
@@ -425,7 +425,7 @@ function shellOperandMatchesClass(operand, className, options, accessKind = oper
         const workspace = options.cwd ? resolveProtectedCandidate(options.cwd) : undefined;
         if (isSameOrDescendant(candidate, managedTemp)
             && (!workspace || !isSameOrDescendant(candidate, workspace))) {
-            return false;
+            return undefined;
         }
     }
     if (className === 'h' && accessKind === 'metadata' && operand.access === 'exact') {
@@ -439,27 +439,31 @@ function shellOperandMatchesClass(operand, className, options, accessKind = oper
             followFinalSymlink: false,
         });
         if (options.allowProtectedMetadata === false) {
-            return metadata.pathClass === 'h-file' || metadata.pathClass === 'h-directory';
+            return metadata.pathClass === 'h-file' || metadata.pathClass === 'h-directory'
+                ? resolveProtectedCandidate(operand.value, options.cwd)
+                : undefined;
         }
         // The no-follow decision is authoritative for metadata. In particular,
         // an ordinary symlink whose target is H-class must remain inspectable as a
         // link; falling through to isHClassPath() would follow it and reject the
         // otherwise safe lstat/stat operation.
         if (metadata.pathClass !== 'unknown' && metadata.allowed) {
-            return false;
+            return undefined;
         }
     }
     const reference = className === 'h' ? containsHClassReference(operand.value) : containsLClassReference(operand.value);
     if (reference)
-        return true;
+        return resolveProtectedCandidate(operand.value, options.cwd);
     if (operand.access === 'recursive') {
-        return className === 'h'
+        const matched = className === 'h'
             ? hClassReadScopeIncludesProtectedPath(operand.value, options)
             : lClassGrantIncludesProtectedPath(operand.value, options);
+        return matched ? resolveProtectedCandidate(operand.value, options.cwd) : undefined;
     }
-    return className === 'h'
+    const matched = className === 'h'
         ? isHClassPath(operand.value, options)
         : isLClassPath(operand.value, options);
+    return matched ? resolveProtectedCandidate(operand.value, options.cwd) : undefined;
 }
 /**
  * A read-only recursive query only needs to cover H-class targets that exist
@@ -489,16 +493,41 @@ function analyzeShellProtectedOperands(command, options) {
         };
     }
     const operands = queryPathOperands(analysis);
-    const lockDiagnostic = /(?:^|[\/\s'"`])(?:[^\s'"`/]*\.lock|EVOLCORE_RUNTIME_LOCK_DIR)(?=$|[\/\s'"`=])/i.test(command);
-    const pathHClass = operands.some(({ operand, accessKind }) => shellOperandMatchesClass(operand, 'h', options, accessKind));
+    // Only parsed path operands can establish a lock-file diagnostic. Searching
+    // the raw command would mistake a grep/rg pattern or report text for an
+    // actual protected filesystem target.
+    const lockDiagnostic = operands.some(({ operand }) => containsLockPathReference(operand.value))
+        || hasFindLockPattern(analysis);
+    const hClassPath = operands.map(({ operand, accessKind }) => shellOperandMatchesClass(operand, 'h', options, accessKind)).find(Boolean);
+    const lClassPath = operands.map(({ operand, accessKind }) => shellOperandMatchesClass(operand, 'l', options, accessKind)).find(Boolean);
     return {
         analysis,
-        hClass: lockDiagnostic || pathHClass,
-        lClass: operands.some(({ operand, accessKind }) => shellOperandMatchesClass(operand, 'l', options, accessKind)),
-        pathHClass,
+        hClass: lockDiagnostic || !!hClassPath,
+        lClass: !!lClassPath,
+        pathHClass: !!hClassPath,
         lockDiagnostic,
+        hClassPath,
+        lClassPath,
     };
 }
+/** Detect a find pattern such as `-name '*.lock'` from parsed argv only. */
+function hasFindLockPattern(analysis) {
+    if (analysis.kind !== 'proven-readonly')
+        return false;
+    return analysis.ir.pipelines.some(pipeline => pipeline.some(command => {
+        if (command.executable !== 'find')
+            return false;
+        for (let index = 0; index < command.argv.length - 1; index++) {
+            if (!['-name', '-iname', '-path', '-ipath', '-wholename'].includes(command.argv[index]))
+                continue;
+            if (/(?:^|[\\/])[^\\/]*\.lock(?:$|[\\/])/i.test(command.argv[index + 1]))
+                return true;
+            if (/^EVOLCORE_RUNTIME_LOCK_DIR$/i.test(command.argv[index + 1]))
+                return true;
+        }
+        return false;
+    }));
+}
 function protectedReadToolPaths(toolName, input) {
     if (toolName === 'Read') {
         return typeof input.file_path === 'string' ? [input.file_path] : [];
@@ -513,33 +542,43 @@ function protectedReadToolPaths(toolName, input) {
 }
 function protectedReadToolMatchesLClass(toolName, input, options) {
     const paths = protectedReadToolPaths(toolName, input);
-    if (paths.some(filePath => containsLClassReference(filePath) || isLClassPath(filePath, options))) {
-        return true;
+    const direct = paths.find(filePath => containsLClassReference(filePath) || isLClassPath(filePath, options));
+    if (direct) {
+        return resolveProtectedCandidate(direct, options.cwd);
     }
     if (toolName === 'Grep') {
         const scope = typeof input.path === 'string' && input.path ? input.path : '.';
-        return lClassGrantIncludesProtectedPath(scope, options);
+        return lClassGrantIncludesProtectedPath(scope, options)
+            ? resolveProtectedCandidate(scope, options.cwd)
+            : undefined;
     }
     if (toolName === 'Glob') {
         const scope = globReadScope(input, options);
-        return lClassGrantIncludesProtectedPath(scope, { root: options.root });
+        return lClassGrantIncludesProtectedPath(scope, { root: options.root })
+            ? resolveProtectedCandidate(scope, options.cwd)
+            : undefined;
     }
-    return false;
+    return undefined;
 }
 function protectedReadToolMatchesHClass(toolName, input, options) {
     const paths = protectedReadToolPaths(toolName, input);
-    if (paths.some(filePath => containsHClassReference(filePath) || isHClassPath(filePath, options))) {
-        return true;
+    const direct = paths.find(filePath => containsHClassReference(filePath) || isHClassPath(filePath, options));
+    if (direct) {
+        return resolveProtectedCandidate(direct, options.cwd);
     }
     if (toolName === 'Grep') {
         const scope = typeof input.path === 'string' && input.path ? input.path : '.';
-        return hClassReadScopeIncludesProtectedPath(scope, options);
+        return hClassReadScopeIncludesProtectedPath(scope, options)
+            ? resolveProtectedCandidate(scope, options.cwd)
+            : undefined;
     }
     if (toolName === 'Glob') {
         const scope = globReadScope(input, options);
-        return hClassReadScopeIncludesProtectedPath(scope, options);
+        return hClassReadScopeIncludesProtectedPath(scope, options)
+            ? resolveProtectedCandidate(scope, options.cwd)
+            : undefined;
     }
-    return false;
+    return undefined;
 }
 function globLiteralPrefix(pattern) {
     const normalized = pattern.replace(/\\/g, '/');
@@ -646,14 +685,17 @@ export function checkReadonly(toolName, input, projectPath, context) {
         if (!protectedReadToolStaysInWorkspace(toolName, input, projectPath)) {
             return { behavior: 'deny', message: '🔒 只读模式：文件读取范围不能越出当前项目目录', policyCode: 'readonly_workspace_escape' };
         }
-        if (paths.some(filePath => containsHClassReference(filePath) || isHClassPath(filePath, pathOptions))) {
-            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径', policyCode: 'readonly_h_class_read' };
+        const directHPath = paths.find(filePath => containsHClassReference(filePath) || isHClassPath(filePath, pathOptions));
+        if (directHPath) {
+            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径', policyCode: 'readonly_h_class_read', matchedPath: resolveProtectedCandidate(directHPath, projectPath) };
         }
-        if (protectedReadToolMatchesHClass(toolName, input, pathOptions)) {
-            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径', policyCode: 'readonly_h_class_read' };
+        const hPath = protectedReadToolMatchesHClass(toolName, input, pathOptions);
+        if (hPath) {
+            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径', policyCode: 'readonly_h_class_read', matchedPath: hPath };
         }
-        if (protectedReadToolMatchesLClass(toolName, input, pathOptions)) {
-            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径', policyCode: 'readonly_l_class_read' };
+        const lPath = protectedReadToolMatchesLClass(toolName, input, pathOptions);
+        if (lPath) {
+            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径', policyCode: 'readonly_l_class_read', matchedPath: lPath };
         }
         return { behavior: 'allow' };
     }
@@ -691,11 +733,15 @@ export function checkReadonly(toolName, input, projectPath, context) {
         }
         if (protectedOperands.hClass) {
             logger.warn(`[ReadonlyCheck] 🔒 H-class path blocked in readonly shell: cmd="${cmd}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-            return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径', policyCode: 'readonly_h_class_read' };
+            if (protectedOperands.analysis.kind === 'proven-readonly') {
+                return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径', policyCode: 'readonly_h_class_read', matchedPath: protectedOperands.hClassPath };
+            }
         }
         if (protectedOperands.lClass) {
             logger.warn(`[ReadonlyCheck] 🔒 L-class path blocked in readonly shell: cmd="${cmd}" session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径', policyCode: 'readonly_l_class_read' };
+            if (protectedOperands.analysis.kind === 'proven-readonly') {
+                return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径', policyCode: 'readonly_l_class_read', matchedPath: protectedOperands.lClassPath };
+            }
         }
         if (protectedOperands.analysis.kind === 'proven-readonly') {
             return { behavior: 'deny', message: '🔒 只读模式：Shell 查询范围不能越出当前项目目录', policyCode: 'readonly_workspace_escape' };
@@ -967,6 +1013,7 @@ export function checkHClassWrite(toolName, input, context) {
             return {
                 behavior: 'deny',
                 message: '🔒 临时文件必须位于当前会话的 $TMPDIR 内',
+                matchedPath: tempCheck.paths[0],
             };
         }
         // A managed temp write is intentionally allowed to contain names such as
@@ -992,6 +1039,7 @@ export function checkHClassWrite(toolName, input, context) {
             return {
                 behavior: 'deny',
                 message: '🔒 Shell 命令涉及受保护的 H 类配置/证书/快照路径，agent 不可直接操作',
+                matchedPath: protectedOperands.hClassPath,
             };
         }
         collectFilesystemGrantPaths(input.additionalPermissions, grantPaths, projectRootGrantSubpaths);
@@ -1010,14 +1058,17 @@ export function checkHClassWrite(toolName, input, context) {
     // filesystem operation is checked again when it reaches Read/Write/Bash,
     // FileChange, or PermissionGrant above.
     const pathOptions = { cwd: context?.projectPath, root: context?.root };
-    if (['Read', 'Glob', 'Grep'].includes(toolName)
-        && protectedReadToolMatchesHClass(toolName, input, pathOptions)) {
-        logger.warn(`[H-Class Protection] 🔒 Protected filesystem read scope blocked: tool=${toolName} ` +
-            `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
-        return {
-            behavior: 'deny',
-            message: '🔒 文件读取范围包含受保护的 H 类配置/证书/快照路径，agent 不可直接操作',
-        };
+    if (['Read', 'Glob', 'Grep'].includes(toolName)) {
+        const matchedReadPath = protectedReadToolMatchesHClass(toolName, input, pathOptions);
+        if (matchedReadPath) {
+            logger.warn(`[H-Class Protection] 🔒 Protected filesystem read scope blocked: tool=${toolName} ` +
+                `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
+            return {
+                behavior: 'deny',
+                message: '🔒 文件读取范围包含受保护的 H 类配置/证书/快照路径，agent 不可直接操作',
+                matchedPath: matchedReadPath,
+            };
+        }
     }
     if (requestsFilesystemRoot(input.permissions) || requestsFilesystemRoot(input.additionalPermissions)) {
         logger.warn(`[H-Class Protection] 🔒 Permission grant covers filesystem root: tool=${toolName} ` +
@@ -1036,6 +1087,7 @@ export function checkHClassWrite(toolName, input, context) {
             return {
                 behavior: 'deny',
                 message: '🔒 请求的文件系统权限范围包含受保护的 H 类路径，已拒绝授权',
+                matchedPath: resolveProtectedCandidate(grantPath, pathOptions.cwd),
             };
         }
     }
@@ -1059,6 +1111,7 @@ export function checkHClassWrite(toolName, input, context) {
             return {
                 behavior: 'deny',
                 message: '🔒 请求的 project_roots 权限范围包含受保护的 H 类路径，已拒绝授权',
+                matchedPath: resolveProtectedCandidate(candidate, permissionWorkspace),
             };
         }
     }
@@ -1093,7 +1146,8 @@ export function checkHClassWrite(toolName, input, context) {
                 behavior: 'deny',
                 message: `🔒 此文件受保护，agent 不可直接写入\n\n` +
                     `文件：${filePath}\n` +
-                    `类型：配置/快照/证书等系统关键文件${suggestion}`
+                    `类型：配置/快照/证书等系统关键文件${suggestion}`,
+                matchedPath: resolveProtectedCandidate(filePath, pathOptions.cwd),
             };
         }
     }
@@ -1108,7 +1162,7 @@ export function checkLClassWrite(toolName, input, context) {
         const pathOptions = { cwd: context?.projectPath, root: context?.root };
         const lClassRead = protectedReadToolMatchesLClass(toolName, input, pathOptions);
         if (lClassRead && context?.permissionMode === 'readonly') {
-            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径' };
+            return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径', matchedPath: lClassRead };
         }
         return { behavior: 'allow' };
     }
@@ -1149,6 +1203,7 @@ export function checkLClassWrite(toolName, input, context) {
                 message: context?.permissionMode === 'readonly'
                     ? '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径'
                     : '🔒 L-class 路径允许读取，但当前 Bash 复合命令无法证明为只读，已拒绝执行。请改用受控的 EvolCore 读取命令或白名单只读命令',
+                matchedPath: protectedOperands.lClassPath,
             };
         }
         collectFilesystemWriteGrantPaths(input.additionalPermissions, writeGrantPaths, projectRootWriteSubpaths);
@@ -1167,6 +1222,7 @@ export function checkLClassWrite(toolName, input, context) {
             return {
                 behavior: 'deny',
                 message: '🔒 请求的文件系统写权限包含 L-class 只读路径，已拒绝授权',
+                matchedPath: resolveProtectedCandidate(grantPath, pathOptions.cwd),
             };
         }
     }
@@ -1188,6 +1244,7 @@ export function checkLClassWrite(toolName, input, context) {
         return {
             behavior: 'deny',
             message: `🔒 L-class 路径允许读取但禁止 Agent 直接修改、删除或移动\n\n文件：${filePath}\n\n💡 请使用对应的 EvolCore 受控命令修改`,
+            matchedPath: resolveProtectedCandidate(filePath, pathOptions.cwd),
         };
     }
     return { behavior: 'allow' };
@@ -1352,7 +1409,8 @@ export function evaluateToolPreflight(toolName, input, context) {
             ? input.commandArgv
             : undefined;
         const outerArgv = explicitCommandArgv ?? parseLiteralShellArgv(command) ?? undefined;
-        const wrappedCommand = outerArgv ? unwrapCodexShellCommandArgv(outerArgv) : undefined;
+        const shellCarrier = outerArgv ? resolveCodexShellCarrierArgv(outerArgv) : undefined;
+        const wrappedCommand = shellCarrier?.command;
         const policyCommand = wrappedCommand ?? command;
         if (context.sessionId && /^\s*(?:command\s+-v|which|type)\s+ec\s*$/i.test(policyCommand)) {
             return {
@@ -1397,7 +1455,9 @@ export function evaluateToolPreflight(toolName, input, context) {
                 policyCode: 'managed_ec_aid_scope_forbidden',
             };
         }
-        const ecCommand = classifyEvolcoreShellCommand(policyCommand);
+        const ecCommand = classifyEvolcoreShellCommand(policyCommand, shellCarrier
+            ? { dialect: shellCarrier.dialect }
+            : {});
         if (ecCommand.kind === 'literal') {
             return { behavior: 'allow', input, reason: 'ec-command' };
         }
@@ -1406,25 +1466,34 @@ export function evaluateToolPreflight(toolName, input, context) {
         }
         if (ecCommand.kind === 'composite') {
             if (ecCommand.issue === 'unsafe-expansion') {
+                const message = shellCarrier?.dialect === 'powershell'
+                    ? '🔒 EC 双引号正文包含未转义的 PowerShell 展开；纯文字请优先使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。PowerShell 传给 ec 时会还原为原文字面量'
+                    : '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量';
                 return {
                     behavior: 'deny',
                     input,
-                    message: '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量',
+                    message,
                     policyCode: 'ec_shell_unsafe_expansion',
                 };
             }
             if (ecCommand.issue === 'invalid-quote') {
+                const message = shellCarrier?.dialect === 'powershell'
+                    ? '🔒 EC 命令引号未闭合或存在错误嵌套；PowerShell 正文内的双引号请用反引号转义，或改用单引号包裹纯文字'
+                    : '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"';
                 return {
                     behavior: 'deny',
                     input,
-                    message: '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"',
+                    message,
                     policyCode: 'ec_shell_invalid_quote',
                 };
             }
+            const message = shellCarrier?.dialect === 'powershell'
+                ? '🔒 EC 命令调用被拒绝：一次 PowerShell/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要拼接探测命令，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开或子表达式追加其它命令。'
+                : '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。';
             return {
                 behavior: 'deny',
                 input,
-                message: '🔒 EC 命令调用被拒绝：一次 Bash/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要先用 `command -v`/`ec aid` 探测，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开、子 shell、`sh -c` 或 `bash -lc` 拼接其它命令。',
+                message,
                 policyCode: 'ec_shell_composite_command',
             };
         }
@@ -1460,7 +1529,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         allowProtectedMetadata: context.allowProtectedMetadata,
     });
     if (hClass.behavior === 'deny') {
-        return { behavior: 'deny', input: checkedInput, message: hClass.message, policyCode: 'h_class_protection' };
+        return { behavior: 'deny', input: checkedInput, message: hClass.message, policyCode: 'h_class_protection', matchedPath: hClass.matchedPath };
     }
     const lClass = checkLClassWrite(toolName, checkedInput, {
         sessionId: context.sessionId,
@@ -1474,7 +1543,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         managedTempDir: context.managedTempDir,
     });
     if (lClass.behavior === 'deny') {
-        return { behavior: 'deny', input: checkedInput, message: lClass.message, policyCode: 'l_class_protection' };
+        return { behavior: 'deny', input: checkedInput, message: lClass.message, policyCode: 'l_class_protection', matchedPath: lClass.matchedPath };
     }
     const dangerous = checkDangerousCommand(toolName, checkedInput);
     if (dangerous.isDangerous

package/dist/core/relation/peer-identity.js

@@ -151,6 +151,24 @@ export class PeerIdentityCache {
      * @param forceRefresh 强制刷新（忽略缓存时效）
      */
     static async resolve(channelType, peerId, agentDir, store, forceRefresh = false) {
+        // A malformed transport envelope must never turn into a relation key such
+        // as `aun#` or trigger an agent.md lookup for an empty AID.  Keep the
+        // fallback in-memory so callers can safely render an unknown peer without
+        // creating a bogus relation directory.
+        if (typeof peerId !== 'string' || !peerId.trim()) {
+            logger.debug(`[PeerIdentityCache] Ignored empty peer id: channel=${channelType}`);
+            return {
+                aid: '',
+                type: 'unknown',
+                isAgent: true,
+                agentMdHash: '',
+                agentMdUpdatedAt: 0,
+                verifiedAt: 0,
+                lastCheckedAt: Date.now(),
+                source: 'unknown',
+            };
+        }
+        peerId = peerId.trim();
         // 1. 缓存检查
         if (!forceRefresh && !this.needsRefresh(channelType, peerId, agentDir)) {
             const cached = this.get(channelType, peerId, agentDir);

package/dist/eck/kit-renderer.js

@@ -4,6 +4,7 @@ import { isEckSnapshotsEnabled } from '../config-store.js';
 import { eckDebugDir } from '../paths.js';
 import { logger } from '../utils/logger.js';
 import { clearRoleStoreCache } from '../config/role-store.js';
+import { resolveAgentLifecycle } from '../config/lifecycle.js';
 import { loadManifest, loadManifestMeta, invalidateManifestCache, evaluateWhen, renderTemplate, renderLoopSection, resolvePathWithDiag, loadSectionFiles, loadChildTemplate, buildPathMappings, shortenPath, } from './manifest-engine.js';
 const DEFAULT_MANIFEST_FILE = 'eck_manifest.json';
 // ── Caches ──
@@ -58,7 +59,15 @@ export function renderKitSections(ctx, manifestFile = DEFAULT_MANIFEST_FILE) {
     const meta = loadManifestMeta(manifestFile);
     const fileParts = [];
     const fragmentParts = [];
-    const pathMappings = buildPathMappings(ctx.vars);
+    // Legacy callers may omit lifecycle; preserve the same active default used
+    // by agent configuration normalization while leaving explicit invalid
+    // values untouched for fail-closed manifest conditions.
+    const resolvedLifecycle = resolveAgentLifecycle({ lifecycle: ctx.vars.lifecycle });
+    const vars = resolvedLifecycle === null
+        ? ctx.vars
+        : { ...ctx.vars, lifecycle: resolvedLifecycle };
+    const renderCtx = { ...ctx, vars };
+    const pathMappings = buildPathMappings(vars);
     const sessionCache = getSessionCache(ctx.sessionId);
     const diagnostics = [];
     // 总闸计数（跨所有段累计）
@@ -78,7 +87,7 @@ export function renderKitSections(ctx, manifestFile = DEFAULT_MANIFEST_FILE) {
         if (capReached) {
             diag.skippedByTotalCap = true;
             // 仅当该段本会命中时才计入"未加载"集合（enabled 且 when 通过）
-            if (section.enabled !== false && evaluateWhen(section.when, ctx.vars)) {
+            if (section.enabled !== false && evaluateWhen(section.when, vars)) {
                 diag.whenPassed = true;
                 skippedByCap.push(section.id);
             }
@@ -90,21 +99,21 @@ export function renderKitSections(ctx, manifestFile = DEFAULT_MANIFEST_FILE) {
             diagnostics.push(diag);
             continue;
         }
-        diag.whenPassed = evaluateWhen(section.when, ctx.vars);
+        diag.whenPassed = evaluateWhen(section.when, vars);
         if (!diag.whenPassed) {
             diag.resolveStatus = 'skipped-when';
             diagnostics.push(diag);
             continue;
         }
         if (rawPath) {
-            const r = resolvePathWithDiag(rawPath, ctx.vars);
+            const r = resolvePathWithDiag(rawPath, vars);
             diag.resolvedPath = r.resolved;
             diag.resolveStatus = r.status;
             if (r.unresolvedTokens.length > 0)
                 diag.unresolvedTokens = r.unresolvedTokens;
         }
         const overflowOut = {};
-        const files = loadSectionFiles(section, ctx.vars, sessionCache, overflowOut);
+        const files = loadSectionFiles(section, vars, sessionCache, overflowOut);
         diag.fileCount = files.length;
         if (overflowOut.value)
             diag.dirOverflow = overflowOut.value;
@@ -124,7 +133,7 @@ export function renderKitSections(ctx, manifestFile = DEFAULT_MANIFEST_FILE) {
                 capReached = true;
                 break;
             }
-            const content = renderSectionContent(section, rawContent, ctx.vars);
+            const content = renderSectionContent(section, rawContent, vars);
             if (!content.trim()) {
                 diag.emptyContent = true;
                 continue;
@@ -151,7 +160,7 @@ export function renderKitSections(ctx, manifestFile = DEFAULT_MANIFEST_FILE) {
         }
         diag.used = anyUsed;
         // 本段触发总闸但一个文件都没用上 → 也算"未加载"
-        if (capReached && !anyUsed && evaluateWhen(section.when, ctx.vars)) {
+        if (capReached && !anyUsed && evaluateWhen(section.when, vars)) {
             diag.skippedByTotalCap = true;
             diag.whenPassed = true;
             skippedByCap.push(section.id);
@@ -169,7 +178,7 @@ export function renderKitSections(ctx, manifestFile = DEFAULT_MANIFEST_FILE) {
         ? `<system-reminder>\nEvolCore Context Kit documents are shown below.\n\n${body}\n\nIMPORTANT: Use this context when it affects the current interaction.\n</system-reminder>`
         : '';
     const fragmentsOutput = fragmentParts.length > 0 ? fragmentParts.join('\n\n') : '';
-    writeDebugFiles(ctx, output, fragmentsOutput, diagnostics);
+    writeDebugFiles(renderCtx, output, fragmentsOutput, diagnostics);
     return output;
 }
 export function cleanEckDebug() {