evolcore 0.0.20 → 0.0.21

package/dist/core/permission/ec-command-parser.js

@@ -10,6 +10,13 @@ const CODEX_POWERSHELL_EXECUTABLES = new Set([
     'pwsh', 'pwsh.exe', 'powershell', 'powershell.exe',
 ]);
 const CODEX_POWERSHELL_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Program Files[\\/]PowerShell[\\/][0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9.-]+)?[\\/]pwsh\.exe|Windows[\\/]System32[\\/]WindowsPowerShell[\\/]v1\.0[\\/]powershell\.exe)$/i;
+const CODEX_CMD_EXECUTABLES = new Set(['cmd', 'cmd.exe']);
+const CODEX_CMD_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Windows[\\/](?:System32|SysWOW64|Sysnative)[\\/]cmd\.exe)$/i;
+// These switches affect only cmd startup/output formatting. `/c` is handled
+// separately as the required execute switch. Flags such as `/k`, `/v:on`,
+// `/e:*`, and `/f:*` can change process lifetime or command semantics and are
+// intentionally not treated as a trusted Codex carrier.
+const CODEX_CMD_INERT_SWITCHES = new Set(['/d', '/s', '/q', '/a', '/u']);
 const SHELL_UNQUOTED_META = new Set([
     ';', '&', '|', '`', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#',
 ]);
@@ -140,12 +147,31 @@ function isLiteralArgBoundary(value) {
 function isShellParameterExpansionStart(value) {
     return value === '(' || value === '{' || !!value && /[A-Za-z0-9_@*#?$!\-]/.test(value);
 }
+function hasCarrierEcCommandPrefix(command, dialect) {
+    if (dialect !== 'cmd')
+        return hasEcCommandPrefix(command);
+    const input = trimShellSpacing(command);
+    const inner = input.length >= 2 && input.startsWith('"') && input.endsWith('"')
+        ? input.slice(1, -1)
+        : input;
+    return /^\s*ec(?:\s|$)/i.test(inner);
+}
+function parseFailure(issue, input, offset, tokenIndex, dialect) {
+    return {
+        ok: false,
+        issue,
+        offset: Math.max(0, Math.min(offset, input.length)),
+        tokenIndex: Math.max(0, tokenIndex),
+        dialect,
+        inputLength: input.length,
+    };
+}
 function parseLiteralPowerShellCommand(command) {
     const input = trimShellSpacing(command);
     if (!input)
-        return { ok: false, issue: 'empty-command' };
+        return parseFailure('empty-command', input, 0, 0, 'powershell');
     if (input.includes('\0'))
-        return { ok: false, issue: 'invalid-control-char' };
+        return parseFailure('invalid-control-char', input, input.indexOf('\0'), 0, 'powershell');
     const argv = [];
     let token = '';
     let tokenStarted = false;
@@ -166,7 +192,7 @@ function parseLiteralPowerShellCommand(command) {
             }
             else if (char === "'") {
                 if (!isLiteralArgBoundary(input[index + 1]))
-                    return { ok: false, issue: 'invalid-quote' };
+                    return parseFailure('invalid-quote', input, index, argv.length, 'powershell');
                 quote = null;
             }
             else {
@@ -177,21 +203,21 @@ function parseLiteralPowerShellCommand(command) {
         if (quote === 'double') {
             if (char === '"') {
                 if (!isLiteralArgBoundary(input[index + 1]))
-                    return { ok: false, issue: 'invalid-quote' };
+                    return parseFailure('invalid-quote', input, index, argv.length, 'powershell');
                 quote = null;
                 continue;
             }
             if (char === '`') {
                 const next = input[++index];
                 if (next === undefined)
-                    return { ok: false, issue: 'invalid-quote' };
+                    return parseFailure('invalid-quote', input, index, argv.length, 'powershell');
                 if (next === '\r' || next === '\n')
-                    return { ok: false, issue: 'structural-newline' };
+                    return parseFailure('structural-newline', input, index, argv.length, 'powershell');
                 token += next;
                 continue;
             }
             if (char === '$' && isShellParameterExpansionStart(input[index + 1])) {
-                return { ok: false, issue: 'unsafe-expansion' };
+                return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
             }
             token += char;
             continue;
@@ -201,9 +227,9 @@ function parseLiteralPowerShellCommand(command) {
             continue;
         }
         if (char === '\r' || char === '\n')
-            return { ok: false, issue: 'structural-newline' };
+            return parseFailure('structural-newline', input, index, argv.length, 'powershell');
         if (/\s/u.test(char) || char.charCodeAt(0) < 0x20 || char === '\x7f') {
-            return { ok: false, issue: 'invalid-control-char' };
+            return parseFailure('invalid-control-char', input, index, argv.length, 'powershell');
         }
         if (char === "'") {
             tokenStarted = true;
@@ -218,9 +244,9 @@ function parseLiteralPowerShellCommand(command) {
         if (char === '`') {
             const next = input[++index];
             if (next === undefined)
-                return { ok: false, issue: 'invalid-quote' };
+                return parseFailure('invalid-quote', input, index, argv.length, 'powershell');
             if (next === '\r' || next === '\n')
-                return { ok: false, issue: 'structural-newline' };
+                return parseFailure('structural-newline', input, index, argv.length, 'powershell');
             tokenStarted = true;
             token += next;
             continue;
@@ -228,17 +254,245 @@ function parseLiteralPowerShellCommand(command) {
         const isWordInitialMeta = (char === '#' || char === '@') && !tokenStarted;
         const isAlwaysMeta = POWERSHELL_UNQUOTED_META.has(char) && char !== '#' && char !== '@';
         if (isAlwaysMeta || isWordInitialMeta || (char === '~' && !tokenStarted)) {
-            return { ok: false, issue: 'shell-composition' };
+            return parseFailure('shell-composition', input, index, argv.length, 'powershell');
         }
         tokenStarted = true;
         token += char;
     }
     if (quote)
-        return { ok: false, issue: 'invalid-quote' };
+        return parseFailure('invalid-quote', input, input.length, argv.length, 'powershell');
     finishToken();
     return argv.length > 0
         ? { ok: true, argv }
-        : { ok: false, issue: 'empty-command' };
+        : parseFailure('empty-command', input, input.length, argv.length, 'powershell');
+}
+function parseLiteralCmdCommand(command, options = {}) {
+    let input = trimShellSpacing(command);
+    if (!input)
+        return parseFailure('empty-command', input, 0, 0, 'cmd');
+    if (input.includes('\0'))
+        return parseFailure('invalid-control-char', input, input.indexOf('\0'), 0, 'cmd');
+    // `cmd.exe /c` commonly wraps the complete command in one quote pair.
+    // Those quotes belong to the carrier, not to the first EC argument; remove
+    // exactly that outer pair before tokenizing the inner command.
+    if (input.length >= 2 && input.startsWith('"') && input.endsWith('"')) {
+        input = input.slice(1, -1);
+    }
+    const argv = [];
+    let token = '';
+    let tokenStarted = false;
+    let quote = false;
+    const finishToken = () => {
+        if (!tokenStarted)
+            return;
+        argv.push(token);
+        token = '';
+        tokenStarted = false;
+    };
+    for (let index = 0; index < input.length; index++) {
+        const char = input[index];
+        if (quote) {
+            if (char === '"') {
+                // cmd.exe represents a literal quote in a quoted argument as `""`.
+                if (input[index + 1] === '"') {
+                    token += '"';
+                    index++;
+                }
+                else {
+                    quote = false;
+                }
+                continue;
+            }
+            // Environment expansion and caret escaping remain active in cmd quoted
+            // strings, so accepting either would make the canonical argv differ
+            // from what cmd.exe actually executes.
+            if (char === '%' || char === '!' || char === '^') {
+                return parseFailure(char === '%' ? 'unsafe-expansion' : 'shell-composition', input, index, argv.length, 'cmd');
+            }
+            if (char === '\r' || char === '\n')
+                return parseFailure('structural-newline', input, index, argv.length, 'cmd');
+            token += char;
+            continue;
+        }
+        if (char === ' ' || char === '\t') {
+            finishToken();
+            continue;
+        }
+        if (char === '\r' || char === '\n')
+            return parseFailure('structural-newline', input, index, argv.length, 'cmd');
+        if (/\s/u.test(char) || char.charCodeAt(0) < 0x20 || char === '\x7f') {
+            return parseFailure('invalid-control-char', input, index, argv.length, 'cmd');
+        }
+        if (char === '"') {
+            tokenStarted = true;
+            quote = true;
+            continue;
+        }
+        if (char === '%' || char === '!') {
+            return parseFailure(char === '%' ? 'unsafe-expansion' : 'shell-composition', input, index, argv.length, 'cmd');
+        }
+        if (char === '^' || char === '&' || char === '|' || char === '<' || char === '>'
+            || char === ';' || char === '(' || char === ')' || char === '*' || char === '?'
+            || char === '[' || char === ']' || char === '{' || char === '}') {
+            return parseFailure('shell-composition', input, index, argv.length, 'cmd');
+        }
+        tokenStarted = true;
+        token += char;
+    }
+    if (quote)
+        return parseFailure('invalid-quote', input, input.length, argv.length, 'cmd');
+    finishToken();
+    return argv.length > 0
+        ? {
+            ok: true,
+            argv: options.allowManagedTmpDir
+                ? argv.map(value => restoreManagedTmpDirToken(value, options.managedTempDir))
+                : argv,
+        }
+        : parseFailure('empty-command', input, input.length, argv.length, 'cmd');
+}
+function isCodexCmdExecutable(value) {
+    if (!value)
+        return false;
+    const normalized = value.toLowerCase();
+    return CODEX_CMD_EXECUTABLES.has(normalized) || CODEX_CMD_INSTALL_PATH_RE.test(value);
+}
+function resolveCodexCmdCarrierArgv(argv) {
+    if (argv.length < 3 || !isCodexCmdExecutable(argv[0]))
+        return undefined;
+    const executeIndex = argv.slice(1, -1).findIndex(value => value.toLowerCase() === '/c');
+    if (executeIndex < 0)
+        return undefined;
+    const absoluteExecuteIndex = executeIndex + 1;
+    // The command must remain one argv item. Joining multiple items would lose
+    // the quoting boundary that the Windows launcher actually executed.
+    if (absoluteExecuteIndex !== argv.length - 2)
+        return undefined;
+    const seen = new Set();
+    for (const rawSwitch of argv.slice(1, absoluteExecuteIndex)) {
+        const switchValue = rawSwitch.toLowerCase();
+        if (!CODEX_CMD_INERT_SWITCHES.has(switchValue) || seen.has(switchValue))
+            return undefined;
+        seen.add(switchValue);
+    }
+    const command = argv.at(-1);
+    return typeof command === 'string' && command.trim()
+        ? { command, dialect: 'cmd' }
+        : undefined;
+}
+/** Resolve a Windows cmd carrier when the app-server provides only a string. */
+function resolveCodexCmdCarrierString(command) {
+    const input = trimShellSpacing(command);
+    // The executable may be quoted when the app-server serializes a Windows
+    // path. Parse the prefix into argv-like switches, then use the same
+    // validation as the commandArgv path so both representations agree.
+    const match = input.match(/^(?:"([^"]+)"|(\S+))((?:\s+\/[^\s]+)*)\s+(.+)$/i);
+    if (!match)
+        return undefined;
+    const executable = match[1] ?? match[2];
+    const rawSwitches = match[3].trim();
+    const switches = rawSwitches ? rawSwitches.split(/[ \t]+/) : [];
+    const argv = [executable, ...switches, match[4]];
+    return resolveCodexCmdCarrierArgv(argv);
+}
+/** Resolve a PowerShell carrier when the app-server provides only a string. */
+function resolveCodexPowerShellCarrierString(command) {
+    const input = trimShellSpacing(command);
+    const match = input.match(/^(?:"([^"]+)"|(\S+))\s+-command\s+(.+)$/i);
+    if (!match)
+        return undefined;
+    const executable = match[1] ?? match[2];
+    const normalized = executable.toLowerCase();
+    const isPowerShell = CODEX_POWERSHELL_EXECUTABLES.has(normalized)
+        || CODEX_POWERSHELL_INSTALL_PATH_RE.test(executable);
+    if (!isPowerShell)
+        return undefined;
+    // A string-form carrier has one additional command-line quoting layer. The
+    // command argument is commonly serialized as `"ec ..."`; remove exactly
+    // that outer pair and leave quotes belonging to EC arguments intact.
+    let nested = match[3].trim();
+    if (nested.length >= 2
+        && ((nested.startsWith('"') && nested.endsWith('"'))
+            || (nested.startsWith("'") && nested.endsWith("'")))) {
+        nested = nested.slice(1, -1);
+    }
+    return nested ? { command: nested, dialect: 'powershell' } : undefined;
+}
+export function resolveCodexShellCarrierString(command) {
+    return resolveCodexCmdCarrierString(command)
+        ?? resolveCodexPowerShellCarrierString(command);
+}
+/**
+ * Extract a trusted cmd executable's command body without trusting its startup
+ * switches. This is used only to classify malformed EC carriers as a
+ * controlled denial; a command with a non-EC body remains an ordinary shell
+ * command and follows the normal approval path.
+ */
+function extractCodexCmdCarrierBody(command) {
+    const input = trimShellSpacing(command);
+    const match = input.match(/^(?:"([^"]+)"|(\S+))((?:\s+\/[^\s]+)*)\s+(.+)$/i);
+    if (!match)
+        return undefined;
+    const executable = match[1] ?? match[2];
+    if (!isCodexCmdExecutable(executable))
+        return undefined;
+    const body = match[4].trim();
+    return body || undefined;
+}
+function extractCodexCmdCarrierBodyArgv(argv) {
+    if (!argv.length || !isCodexCmdExecutable(argv[0]))
+        return undefined;
+    let bodyIndex = 1;
+    for (; bodyIndex < argv.length; bodyIndex++) {
+        const value = argv[bodyIndex];
+        if (value.toLowerCase() === '/c') {
+            bodyIndex++;
+            break;
+        }
+        // This is deliberately loose. It is only used to identify a malformed
+        // carrier that should be denied, never to authorize a command.
+        if (!value.startsWith('/'))
+            break;
+    }
+    const body = argv.slice(bodyIndex).join(' ').trim();
+    return body || undefined;
+}
+function looksLikeEcCommandBody(command) {
+    if (!command)
+        return false;
+    const input = command.trim();
+    const body = (input.startsWith('"') ? input.slice(1) : input).trimStart();
+    return /^ec(?:\s|$)/i.test(body);
+}
+/** True only when a trusted cmd executable is carrying an EC command body. */
+export function hasCodexCmdCarrierEcIntent(input) {
+    if (Array.isArray(input.commandArgv)
+        && input.commandArgv.every(value => typeof value === 'string')) {
+        return looksLikeEcCommandBody(extractCodexCmdCarrierBodyArgv(input.commandArgv));
+    }
+    return typeof input.command === 'string'
+        && looksLikeEcCommandBody(extractCodexCmdCarrierBody(input.command));
+}
+function parseCodexCmdCarrierArgvFailure(argv) {
+    const body = extractCodexCmdCarrierBodyArgv(argv);
+    if (!body || !looksLikeEcCommandBody(body))
+        return undefined;
+    const nested = parseLiteralShellCommand(body, { dialect: 'cmd', allowManagedTmpDir: true });
+    if (!nested.ok)
+        return nested;
+    return parseFailure('shell-composition', body, 0, 0, 'cmd');
+}
+function parseCodexCmdCarrierStringFailure(command, options = {}) {
+    const body = extractCodexCmdCarrierBody(command);
+    if (!body || !looksLikeEcCommandBody(body))
+        return undefined;
+    const nested = parseLiteralShellCommand(body, {
+        ...options,
+        dialect: 'cmd',
+    });
+    return nested.ok
+        ? parseFailure('shell-composition', body, 0, 0, 'cmd')
+        : nested;
 }
 function doubleQuotedIssueAt(input, index) {
     const char = input[index];
@@ -262,13 +516,16 @@ export function parseLiteralShellCommand(command, options = {}) {
     if (options.dialect === 'powershell') {
         return parseLiteralPowerShellCommand(command);
     }
+    if (options.dialect === 'cmd') {
+        return parseLiteralCmdCommand(command, options);
+    }
     const input = trimShellSpacing(options.allowManagedTmpDir
         ? substituteManagedTmpDirToken(command)
         : command);
     if (!input)
-        return { ok: false, issue: 'empty-command' };
+        return parseFailure('empty-command', input, 0, 0, 'posix');
     if (input.includes('\0'))
-        return { ok: false, issue: 'invalid-control-char' };
+        return parseFailure('invalid-control-char', input, input.indexOf('\0'), 0, 'posix');
     const argv = [];
     let token = '';
     let tokenStarted = false;
@@ -285,7 +542,7 @@ export function parseLiteralShellCommand(command, options = {}) {
         if (quote === 'single') {
             if (char === "'") {
                 if (!isLiteralArgBoundary(input[index + 1]))
-                    return { ok: false, issue: 'invalid-quote' };
+                    return parseFailure('invalid-quote', input, index, argv.length, 'posix');
                 quote = null;
             }
             else
@@ -295,13 +552,13 @@ export function parseLiteralShellCommand(command, options = {}) {
         if (quote === 'double') {
             if (char === '"') {
                 if (!isLiteralArgBoundary(input[index + 1]))
-                    return { ok: false, issue: 'invalid-quote' };
+                    return parseFailure('invalid-quote', input, index, argv.length, 'posix');
                 quote = null;
                 continue;
             }
             const issue = doubleQuotedIssueAt(input, index);
             if (issue)
-                return { ok: false, issue };
+                return parseFailure(issue, input, index, argv.length, 'posix');
             if (char === '\\') {
                 const next = input[++index];
                 token += ['"', '\\', '$', '`'].includes(next) ? next : `\\${next}`;
@@ -321,9 +578,9 @@ export function parseLiteralShellCommand(command, options = {}) {
         // keeps inside the executable name; accepting those would misclassify a
         // different executable as `ec`.
         if (char === '\r' || char === '\n')
-            return { ok: false, issue: 'structural-newline' };
+            return parseFailure('structural-newline', input, index, argv.length, 'posix');
         if (/\s/u.test(char) || char.charCodeAt(0) < 0x20 || char === '\x7f') {
-            return { ok: false, issue: 'invalid-control-char' };
+            return parseFailure('invalid-control-char', input, index, argv.length, 'posix');
         }
         if (char === "'") {
             tokenStarted = true;
@@ -338,9 +595,9 @@ export function parseLiteralShellCommand(command, options = {}) {
         if (char === '\\') {
             const next = input[++index];
             if (next === undefined)
-                return { ok: false, issue: 'invalid-quote' };
+                return parseFailure('invalid-quote', input, index, argv.length, 'posix');
             if (next === '\r' || next === '\n')
-                return { ok: false, issue: 'structural-newline' };
+                return parseFailure('structural-newline', input, index, argv.length, 'posix');
             tokenStarted = true;
             token += next;
             continue;
@@ -349,12 +606,12 @@ export function parseLiteralShellCommand(command, options = {}) {
         // peer keys such as `aun#alice` are ordinary literal arguments.
         if ((SHELL_UNQUOTED_META.has(char) && (char !== '#' || !tokenStarted))
             || (char === '~' && !tokenStarted))
-            return { ok: false, issue: 'shell-composition' };
+            return parseFailure('shell-composition', input, index, argv.length, 'posix');
         tokenStarted = true;
         token += char;
     }
     if (quote)
-        return { ok: false, issue: 'invalid-quote' };
+        return parseFailure('invalid-quote', input, input.length, argv.length, 'posix');
     finishToken();
     return argv.length > 0
         ? {
@@ -363,24 +620,28 @@ export function parseLiteralShellCommand(command, options = {}) {
                 ? argv.map(value => restoreManagedTmpDirToken(value, options.managedTempDir))
                 : argv,
         }
-        : { ok: false, issue: 'empty-command' };
+        : parseFailure('empty-command', input, input.length, argv.length, 'posix');
 }
 export function parseLiteralShellArgv(command, options = {}) {
     const result = parseLiteralShellCommand(command, options);
     return result.ok ? result.argv : null;
 }
 export function resolveCodexShellCarrierArgv(argv) {
-    if (argv.length !== 3)
-        return undefined;
-    if (argv[1] === '-lc' && CODEX_POSIX_SHELL_EXECUTABLES.has(argv[0])) {
+    if (argv.length === 3 && argv[1] === '-lc' && CODEX_POSIX_SHELL_EXECUTABLES.has(argv[0])) {
         return { command: argv[2], dialect: 'posix' };
     }
-    const powershellExecutable = argv[0].toLowerCase();
-    const isPowerShell = CODEX_POWERSHELL_EXECUTABLES.has(powershellExecutable)
-        || CODEX_POWERSHELL_INSTALL_PATH_RE.test(argv[0]);
-    return isPowerShell && argv[1].toLowerCase() === '-command'
-        ? { command: argv[2], dialect: 'powershell' }
-        : undefined;
+    if (argv.length === 3) {
+        const powershellExecutable = argv[0].toLowerCase();
+        const isPowerShell = CODEX_POWERSHELL_EXECUTABLES.has(powershellExecutable)
+            || CODEX_POWERSHELL_INSTALL_PATH_RE.test(argv[0]);
+        if (isPowerShell && argv[1].toLowerCase() === '-command') {
+            return { command: argv[2], dialect: 'powershell' };
+        }
+    }
+    // Node/cross-spawn and Codex use cmd.exe with a small set of startup flags.
+    // The execute switch must be the final switch before one command argument;
+    // validation itself is shared with string-only Windows payloads below.
+    return resolveCodexCmdCarrierArgv(argv);
 }
 export function unwrapCodexShellCommandArgv(argv) {
     return resolveCodexShellCarrierArgv(argv)?.command;
@@ -392,31 +653,81 @@ export function unwrapCodexShellCommandArgv(argv) {
  */
 export function parseCodexShellCommandArgv(command, options = {}) {
     const outer = parseLiteralShellArgv(command, options);
-    if (!outer)
+    if (outer) {
+        const carrier = resolveCodexShellCarrierArgv(outer);
+        if (carrier !== undefined) {
+            return parseLiteralShellArgv(carrier.command, { ...options, dialect: carrier.dialect });
+        }
+        const stringCarrier = resolveCodexShellCarrierString(command);
+        if (stringCarrier) {
+            return parseLiteralShellArgv(stringCarrier.command, { ...options, dialect: stringCarrier.dialect });
+        }
+        if (parseCodexCmdCarrierStringFailure(command, options))
+            return null;
+        return outer;
+    }
+    const stringCarrier = resolveCodexShellCarrierString(command);
+    if (!stringCarrier)
         return null;
-    const carrier = resolveCodexShellCarrierArgv(outer);
-    return carrier === undefined
-        ? outer
-        : parseLiteralShellArgv(carrier.command, { ...options, dialect: carrier.dialect });
+    const parsed = parseLiteralShellCommand(stringCarrier.command, {
+        ...options,
+        dialect: stringCarrier.dialect,
+    });
+    return parsed.ok ? parsed.argv : null;
 }
-/**
- * Resolve a Codex command input while preserving the raw `commandArgv` form
- * supplied by app-server. Joining that argv with spaces loses the quoting of
- * the inner `-lc` command and was the source of a false proactive denial.
- */
-export function parseCodexToolCommandArgv(input) {
-    if (Array.isArray(input.commandArgv) && input.commandArgv.every(value => typeof value === 'string')) {
+/** Parse a Codex tool input while preserving safe syntax failure metadata. */
+export function parseCodexToolCommand(input) {
+    if (Array.isArray(input.commandArgv)) {
+        if (!input.commandArgv.every(value => typeof value === 'string')) {
+            return parseFailure('invalid-control-char', '', 0, 0, 'posix');
+        }
         const outer = input.commandArgv;
+        const nulIndex = outer.findIndex(value => value.includes('\0'));
+        if (nulIndex >= 0)
+            return parseFailure('invalid-control-char', '', 0, nulIndex, 'posix');
         const carrier = resolveCodexShellCarrierArgv(outer);
-        return carrier === undefined
-            ? outer
-            : parseLiteralShellArgv(carrier.command, {
+        if (carrier === undefined) {
+            return parseCodexCmdCarrierArgvFailure(outer) ?? { ok: true, argv: outer };
+        }
+        return parseLiteralShellCommand(carrier.command, {
+            allowManagedTmpDir: true,
+            dialect: carrier.dialect,
+        });
+    }
+    const command = typeof input.command === 'string' ? input.command : '';
+    const outer = parseLiteralShellCommand(command, { allowManagedTmpDir: true });
+    if (outer.ok) {
+        const carrier = resolveCodexShellCarrierArgv(outer.argv);
+        if (carrier !== undefined) {
+            return parseLiteralShellCommand(carrier.command, {
                 allowManagedTmpDir: true,
                 dialect: carrier.dialect,
             });
+        }
+        const stringCarrier = resolveCodexShellCarrierString(command);
+        return stringCarrier
+            ? parseLiteralShellCommand(stringCarrier.command, {
+                allowManagedTmpDir: true,
+                dialect: stringCarrier.dialect,
+            })
+            : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true }) ?? outer;
     }
-    const command = typeof input.command === 'string' ? input.command : '';
-    return parseCodexShellCommandArgv(command, { allowManagedTmpDir: true });
+    const stringCarrier = resolveCodexShellCarrierString(command);
+    return stringCarrier
+        ? parseLiteralShellCommand(stringCarrier.command, {
+            allowManagedTmpDir: true,
+            dialect: stringCarrier.dialect,
+        })
+        : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true }) ?? outer;
+}
+/**
+ * Resolve a Codex command input while preserving the raw `commandArgv` form
+ * supplied by app-server. Joining that argv with spaces loses the quoting of
+ * the inner `-lc` command and was the source of a false proactive denial.
+ */
+export function parseCodexToolCommandArgv(input) {
+    const result = parseCodexToolCommand(input);
+    return result.ok ? result.argv : null;
 }
 function isSimpleExecStringLiteral(value) {
     const quote = value[0];
@@ -1109,13 +1420,58 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
             });
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
-            if (!nested.ok && hasEcCommandPrefix(carrier.command)) {
+            if (!nested.ok && hasCarrierEcCommandPrefix(carrier.command, carrier.dialect)) {
+                return { kind: 'composite', issue: nested.issue };
+            }
+        }
+        const stringCarrier = resolveCodexShellCarrierString(command);
+        if (stringCarrier) {
+            const nested = parseLiteralShellCommand(stringCarrier.command, {
+                ...parseOptions,
+                dialect: stringCarrier.dialect,
+            });
+            if (nested.ok && nested.argv[0] === 'ec')
+                return { kind: 'literal' };
+            if (!nested.ok && hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
+        const malformedCmdBody = extractCodexCmdCarrierBody(command);
+        if (malformedCmdBody && looksLikeEcCommandBody(malformedCmdBody)) {
+            const nested = parseLiteralShellCommand(malformedCmdBody, {
+                ...parseOptions,
+                dialect: 'cmd',
+            });
+            return nested.ok
+                ? { kind: 'composite', issue: 'shell-composition' }
+                : { kind: 'composite', issue: nested.issue };
+        }
+        return { kind: 'none' };
+    }
+    const stringCarrier = resolveCodexShellCarrierString(command);
+    if (stringCarrier) {
+        const nested = parseLiteralShellCommand(stringCarrier.command, {
+            ...parseOptions,
+            dialect: stringCarrier.dialect,
+        });
+        if (nested.ok && nested.argv[0] === 'ec')
+            return { kind: 'literal' };
+        if (!nested.ok && hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)) {
+            return { kind: 'composite', issue: nested.issue };
+        }
         return { kind: 'none' };
     }
-    const boundedOutput = options.dialect === 'powershell'
+    const malformedCmdBody = extractCodexCmdCarrierBody(command);
+    if (malformedCmdBody && looksLikeEcCommandBody(malformedCmdBody)) {
+        const nested = parseLiteralShellCommand(malformedCmdBody, {
+            ...parseOptions,
+            dialect: 'cmd',
+        });
+        return nested.ok
+            ? { kind: 'composite', issue: 'shell-composition' }
+            : { kind: 'composite', issue: nested.issue };
+    }
+    const boundedOutput = options.dialect === 'powershell' || options.dialect === 'cmd'
         ? null
         : parseBoundedOutputShellCommand(command);
     if (boundedOutput && boundedOutput.argv[0] === 'ec') {