evolcore 0.0.20 → 0.0.22

package/dist/core/permission/ec-command-parser.js

@@ -1,15 +1,32 @@
+import { isTrustedWindowsShellExecutable } from '../../utils/windows-shell-trust.js';
 const HEAD_EXECUTABLES = new Set(['head', '/bin/head', '/usr/bin/head']);
 // Codex app-server sends command executions through a fixed shell carrier.
 // Treat the carrier as syntax only after parsing it as literal argv; never
 // accept an arbitrary shell command string or unwrap composition here.
 const CODEX_POSIX_SHELL_EXECUTABLES = new Set([
-    'bash', '/bin/bash', '/usr/bin/bash',
-    'sh', '/bin/sh', '/usr/bin/sh',
+    'bash', 'bash.exe', '/bin/bash', '/usr/bin/bash',
+    'sh', 'sh.exe', '/bin/sh', '/usr/bin/sh',
 ]);
 const CODEX_POWERSHELL_EXECUTABLES = new Set([
     'pwsh', 'pwsh.exe', 'powershell', 'powershell.exe',
 ]);
 const CODEX_POWERSHELL_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Program Files[\\/]PowerShell[\\/][0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9.-]+)?[\\/]pwsh\.exe|Windows[\\/]System32[\\/]WindowsPowerShell[\\/]v1\.0[\\/]powershell\.exe)$/i;
+const CODEX_CUSTOM_POSIX_SHELL_NAMES = new Set(['bash', 'bash.exe', 'sh', 'sh.exe']);
+const CODEX_CUSTOM_POWERSHELL_NAMES = new Set(['pwsh.exe', 'powershell.exe']);
+const CODEX_CUSTOM_CMD_NAMES = new Set(['cmd.exe']);
+const CODEX_CMD_EXECUTABLES = new Set(['cmd', 'cmd.exe']);
+const CODEX_CMD_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Windows[\\/](?:System32|SysWOW64|Sysnative)[\\/]cmd\.exe)$/i;
+// These switches affect only cmd startup/output formatting. `/c` is handled
+// separately as the required execute switch. Flags such as `/k`, `/v:on`,
+// `/e:*`, and `/f:*` can change process lifetime or command semantics and are
+// intentionally not treated as a trusted Codex carrier.
+const CODEX_CMD_INERT_SWITCHES = new Set(['/d', '/s', '/q', '/a', '/u']);
+const EVOLCORE_EXECUTABLE_ALIASES = new Set(['ec', 'ec.cmd', 'ec.exe']);
+const EVOLCORE_NODE_EXECUTABLES = new Set(['node', 'node.exe']);
+// Development/install entrypoints that are part of this repository's CLI.
+// Only these exact relative paths are canonicalized; arbitrary Node scripts
+// must never become an EC command merely because their filename is similar.
+const EVOLCORE_NODE_WRAPPER_PATHS = new Set(['bin/ec.js', 'dist/cli/index.js']);
 const SHELL_UNQUOTED_META = new Set([
     ';', '&', '|', '`', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#',
 ]);
@@ -61,8 +78,7 @@ function hasEcCommandPrefix(command) {
         }
         if (boundary && /\s/.test(char))
             continue;
-        if (boundary && command.slice(index, index + 2).toLowerCase() === 'ec'
-            && (index + 2 === command.length || /\s|[;&|`()<>]/.test(command[index + 2])))
+        if (boundary && /^ec(?:\.cmd|\.exe)?(?=$|\s|[;&|`()<>])/i.test(command.slice(index)))
             return true;
         boundary = false;
     }
@@ -71,6 +87,45 @@ function hasEcCommandPrefix(command) {
 function trimShellSpacing(value) {
     return value.replace(/^[ \t]+|[ \t]+$/g, '');
 }
+/**
+ * Accept an explicitly materialized absolute shell path, including Windows
+ * Store/App Execution Alias paths such as `...\\WindowsApps\\pwsh.exe`.
+ * Relative names remain restricted to the fixed executable allowlists above.
+ */
+function isAbsoluteCustomShellPath(value, executableNames) {
+    if (!value || /[\0\r\n"'<>|?*]/.test(value))
+        return false;
+    const normalized = value.replaceAll('\\', '/');
+    if (!/^[A-Za-z]:\//.test(normalized) && !normalized.startsWith('//'))
+        return false;
+    const basename = normalized.slice(normalized.lastIndexOf('/') + 1).toLowerCase();
+    return executableNames.has(basename);
+}
+function isNodeExecutable(value) {
+    if (!value)
+        return false;
+    const normalized = value.toLowerCase();
+    return EVOLCORE_NODE_EXECUTABLES.has(normalized)
+        || isAbsoluteCustomShellPath(value, EVOLCORE_NODE_EXECUTABLES);
+}
+function normalizeNodeWrapperPath(value) {
+    const normalized = value.replaceAll('\\', '/').replace(/^\.\//, '').toLowerCase();
+    return EVOLCORE_NODE_WRAPPER_PATHS.has(normalized) ? normalized : undefined;
+}
+function isCodexPosixShellExecutable(value) {
+    if (!value)
+        return false;
+    return CODEX_POSIX_SHELL_EXECUTABLES.has(value.toLowerCase())
+        || isAbsoluteCustomShellPath(value, CODEX_CUSTOM_POSIX_SHELL_NAMES);
+}
+function isCodexPowerShellExecutable(value) {
+    if (!value)
+        return false;
+    const normalized = value.toLowerCase();
+    return CODEX_POWERSHELL_EXECUTABLES.has(normalized)
+        || CODEX_POWERSHELL_INSTALL_PATH_RE.test(value)
+        || isAbsoluteCustomShellPath(value, CODEX_CUSTOM_POWERSHELL_NAMES);
+}
 const MANAGED_TMPDIR_TOKEN = '__EC_MANAGED_TMPDIR__';
 /**
  * Preserve the one environment reference allowed in managed EC paths.
@@ -140,12 +195,179 @@ function isLiteralArgBoundary(value) {
 function isShellParameterExpansionStart(value) {
     return value === '(' || value === '{' || !!value && /[A-Za-z0-9_@*#?$!\-]/.test(value);
 }
+function hasCarrierEcCommandPrefix(command, dialect) {
+    if (dialect !== 'cmd')
+        return hasEcCommandPrefix(command);
+    const input = trimShellSpacing(command);
+    const inner = input.length >= 2 && input.startsWith('"') && input.endsWith('"')
+        ? input.slice(1, -1)
+        : input;
+    return /^\s*ec(?:\.cmd|\.exe)?(?:\s|$)/i.test(inner);
+}
+/** Normalize the Windows npm shims to the canonical EvolCore CLI name. */
+export function normalizeEvolcoreCommandArgv(argv) {
+    if (argv.length === 0)
+        return [];
+    const executable = argv[0];
+    if (typeof executable === 'string' && EVOLCORE_EXECUTABLE_ALIASES.has(executable.toLowerCase())) {
+        return ['ec', ...argv.slice(1)];
+    }
+    if (typeof executable === 'string' && isNodeExecutable(executable) && argv.length >= 2
+        && typeof argv[1] === 'string' && normalizeNodeWrapperPath(argv[1])) {
+        return ['ec', ...argv.slice(2)];
+    }
+    return [...argv];
+}
+/** Detect the historical PowerShell pattern that overwrote the thread carrier. */
+export function hasPowerShellDelegationAssignment(command) {
+    return /^\s*\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(command)
+        && /\bec(?:\.cmd|\.exe)?(?:\s|$)/i.test(command);
+}
+/**
+ * Windows Codex may materialize one environment variable assignment directly
+ * in the PowerShell command body instead of inheriting it from the process
+ * environment. Only the EvolCore delegation variable is accepted, and only
+ * when followed by one command on the same carrier. The value is validated for
+ * shape but never trusted for authorization; the runner still arms the stable
+ * in-memory thread carrier.
+ */
+function unwrapPowerShellDelegationPrefix(command) {
+    const input = command.trim();
+    if (!/^\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(input)) {
+        return { kind: 'none', command };
+    }
+    let index = 0;
+    const skipSpace = () => {
+        while (index < input.length && (input[index] === ' ' || input[index] === '\t'))
+            index++;
+    };
+    const consume = (value) => {
+        if (input.slice(index, index + value.length).toLowerCase() !== value.toLowerCase())
+            return false;
+        index += value.length;
+        return true;
+    };
+    skipSpace();
+    if (!consume('$env') || input[index] !== ':')
+        return { kind: 'invalid', command };
+    index++;
+    skipSpace();
+    if (!consume('EVOLCORE_DELEGATION_TOKEN'))
+        return { kind: 'invalid', command };
+    skipSpace();
+    if (input[index] !== '=')
+        return { kind: 'invalid', command };
+    index++;
+    skipSpace();
+    const quote = input[index];
+    if (quote !== "'" && quote !== '"')
+        return { kind: 'invalid', command };
+    const valueStart = index++;
+    let value = '';
+    let closed = false;
+    // When the complete -Command body is itself single-quoted, command-line
+    // serialization can leave the assignment value in a doubled `''token''`
+    // form. Its token alphabet cannot contain quotes, so this exact shape is
+    // unambiguous and can be decoded without executing PowerShell grammar.
+    if (quote === "'" && input[valueStart + 1] === "'") {
+        const contentStart = valueStart + 2;
+        const end = input.indexOf("''", contentStart);
+        if (end < contentStart)
+            return { kind: 'invalid', command };
+        value = input.slice(contentStart, end);
+        index = end + 2;
+        closed = true;
+    }
+    while (index < input.length) {
+        if (closed)
+            break;
+        const char = input[index];
+        if (char === quote) {
+            // PowerShell single-quoted strings escape a quote as `''`. For the
+            // delegation token alphabet this is not needed, but accepting it lets us
+            // decode the doubled-quote form emitted by powershell.exe argv quoting.
+            if (quote === "'" && input[index + 1] === "'") {
+                value += "'";
+                index += 2;
+                continue;
+            }
+            index++;
+            closed = true;
+            break;
+        }
+        if (quote === '"' && char === '`')
+            return { kind: 'invalid', command };
+        if (char === '\r' || char === '\n')
+            return { kind: 'invalid', command };
+        value += char;
+        index++;
+    }
+    if (!closed || index <= valueStart + 1 || !/^[A-Za-z0-9_-]{32,128}$/.test(value)) {
+        return { kind: 'invalid', command };
+    }
+    if (input[index] !== ';')
+        return { kind: 'invalid', command };
+    index++;
+    const remainder = input.slice(index).trim();
+    if (!remainder)
+        return { kind: 'invalid', command };
+    return { kind: 'valid', command: remainder, token: value };
+}
+export function parseCodexCarrierCommand(carrier, options = {}) {
+    if (options.verifyShellExecutable) {
+        if (!carrier.executable) {
+            return parseFailure('untrusted-shell', carrier.command, 0, 0, carrier.dialect);
+        }
+        const kind = carrier.dialect === 'posix' ? 'bash' : carrier.dialect;
+        if (!isTrustedWindowsShellExecutable(carrier.executable, kind)) {
+            return parseFailure('untrusted-shell', carrier.command, 0, 0, carrier.dialect);
+        }
+    }
+    const unwrapped = carrier.dialect === 'powershell'
+        ? unwrapPowerShellDelegationPrefix(carrier.command)
+        : { kind: 'none', command: carrier.command };
+    // Windows PowerShell may materialize the thread's shell environment as a
+    // single `$env:EVOLCORE_DELEGATION_TOKEN = '...'` prefix. Keep the token as
+    // metadata for the approval layer, which must compare it with the runner's
+    // in-memory carrier before arming delegation. Malformed or unrelated
+    // assignments remain syntax failures and can never be authorized.
+    if (unwrapped.kind === 'invalid'
+        || (carrier.dialect === 'powershell'
+            && hasPowerShellDelegationAssignment(carrier.command)
+            && unwrapped.kind === 'none')
+        || (unwrapped.kind === 'valid'
+            && options.expectedDelegationToken !== undefined
+            && options.expectedDelegationToken !== unwrapped.token)) {
+        return parseFailure('shell-composition', carrier.command, 0, 0, carrier.dialect);
+    }
+    const parsed = parseLiteralShellCommand(unwrapped.command, {
+        ...options,
+        dialect: carrier.dialect,
+    });
+    return parsed.ok
+        ? {
+            ...parsed,
+            argv: normalizeEvolcoreCommandArgv(parsed.argv),
+            ...(unwrapped.kind === 'valid' ? { delegationToken: unwrapped.token } : {}),
+        }
+        : parsed;
+}
+function parseFailure(issue, input, offset, tokenIndex, dialect) {
+    return {
+        ok: false,
+        issue,
+        offset: Math.max(0, Math.min(offset, input.length)),
+        tokenIndex: Math.max(0, tokenIndex),
+        dialect,
+        inputLength: input.length,
+    };
+}
 function parseLiteralPowerShellCommand(command) {
     const input = trimShellSpacing(command);
     if (!input)
-        return { ok: false, issue: 'empty-command' };
+        return parseFailure('empty-command', input, 0, 0, 'powershell');
     if (input.includes('\0'))
-        return { ok: false, issue: 'invalid-control-char' };
+        return parseFailure('invalid-control-char', input, input.indexOf('\0'), 0, 'powershell');
     const argv = [];
     let token = '';
     let tokenStarted = false;
@@ -166,7 +388,7 @@ function parseLiteralPowerShellCommand(command) {
             }
             else if (char === "'") {
                 if (!isLiteralArgBoundary(input[index + 1]))
-                    return { ok: false, issue: 'invalid-quote' };
+                    return parseFailure('invalid-quote', input, index, argv.length, 'powershell');
                 quote = null;
             }
             else {
@@ -177,21 +399,21 @@ function parseLiteralPowerShellCommand(command) {
         if (quote === 'double') {
             if (char === '"') {
                 if (!isLiteralArgBoundary(input[index + 1]))
-                    return { ok: false, issue: 'invalid-quote' };
+                    return parseFailure('invalid-quote', input, index, argv.length, 'powershell');
                 quote = null;
                 continue;
             }
             if (char === '`') {
                 const next = input[++index];
                 if (next === undefined)
-                    return { ok: false, issue: 'invalid-quote' };
+                    return parseFailure('invalid-quote', input, index, argv.length, 'powershell');
                 if (next === '\r' || next === '\n')
-                    return { ok: false, issue: 'structural-newline' };
+                    return parseFailure('structural-newline', input, index, argv.length, 'powershell');
                 token += next;
                 continue;
             }
             if (char === '$' && isShellParameterExpansionStart(input[index + 1])) {
-                return { ok: false, issue: 'unsafe-expansion' };
+                return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
             }
             token += char;
             continue;
@@ -201,9 +423,9 @@ function parseLiteralPowerShellCommand(command) {
             continue;
         }
         if (char === '\r' || char === '\n')
-            return { ok: false, issue: 'structural-newline' };
+            return parseFailure('structural-newline', input, index, argv.length, 'powershell');
         if (/\s/u.test(char) || char.charCodeAt(0) < 0x20 || char === '\x7f') {
-            return { ok: false, issue: 'invalid-control-char' };
+            return parseFailure('invalid-control-char', input, index, argv.length, 'powershell');
         }
         if (char === "'") {
             tokenStarted = true;
@@ -218,9 +440,9 @@ function parseLiteralPowerShellCommand(command) {
         if (char === '`') {
             const next = input[++index];
             if (next === undefined)
-                return { ok: false, issue: 'invalid-quote' };
+                return parseFailure('invalid-quote', input, index, argv.length, 'powershell');
             if (next === '\r' || next === '\n')
-                return { ok: false, issue: 'structural-newline' };
+                return parseFailure('structural-newline', input, index, argv.length, 'powershell');
             tokenStarted = true;
             token += next;
             continue;
@@ -228,17 +450,264 @@ function parseLiteralPowerShellCommand(command) {
         const isWordInitialMeta = (char === '#' || char === '@') && !tokenStarted;
         const isAlwaysMeta = POWERSHELL_UNQUOTED_META.has(char) && char !== '#' && char !== '@';
         if (isAlwaysMeta || isWordInitialMeta || (char === '~' && !tokenStarted)) {
-            return { ok: false, issue: 'shell-composition' };
+            return parseFailure('shell-composition', input, index, argv.length, 'powershell');
         }
         tokenStarted = true;
         token += char;
     }
     if (quote)
-        return { ok: false, issue: 'invalid-quote' };
+        return parseFailure('invalid-quote', input, input.length, argv.length, 'powershell');
     finishToken();
     return argv.length > 0
         ? { ok: true, argv }
-        : { ok: false, issue: 'empty-command' };
+        : parseFailure('empty-command', input, input.length, argv.length, 'powershell');
+}
+function parseLiteralCmdCommand(command, options = {}) {
+    let input = trimShellSpacing(command);
+    if (!input)
+        return parseFailure('empty-command', input, 0, 0, 'cmd');
+    if (input.includes('\0'))
+        return parseFailure('invalid-control-char', input, input.indexOf('\0'), 0, 'cmd');
+    // `cmd.exe /c` commonly wraps the complete command in one quote pair.
+    // Those quotes belong to the carrier, not to the first EC argument; remove
+    // exactly that outer pair before tokenizing the inner command.
+    if (input.length >= 2 && input.startsWith('"') && input.endsWith('"')) {
+        input = input.slice(1, -1);
+    }
+    const argv = [];
+    let token = '';
+    let tokenStarted = false;
+    let quote = false;
+    const finishToken = () => {
+        if (!tokenStarted)
+            return;
+        argv.push(token);
+        token = '';
+        tokenStarted = false;
+    };
+    for (let index = 0; index < input.length; index++) {
+        const char = input[index];
+        if (quote) {
+            if (char === '"') {
+                // cmd.exe represents a literal quote in a quoted argument as `""`.
+                if (input[index + 1] === '"') {
+                    token += '"';
+                    index++;
+                }
+                else {
+                    quote = false;
+                }
+                continue;
+            }
+            // Environment expansion and caret escaping remain active in cmd quoted
+            // strings, so accepting either would make the canonical argv differ
+            // from what cmd.exe actually executes.
+            if (char === '%' || char === '!' || char === '^') {
+                return parseFailure(char === '%' ? 'unsafe-expansion' : 'shell-composition', input, index, argv.length, 'cmd');
+            }
+            if (char === '\r' || char === '\n')
+                return parseFailure('structural-newline', input, index, argv.length, 'cmd');
+            token += char;
+            continue;
+        }
+        if (char === ' ' || char === '\t') {
+            finishToken();
+            continue;
+        }
+        if (char === '\r' || char === '\n')
+            return parseFailure('structural-newline', input, index, argv.length, 'cmd');
+        if (/\s/u.test(char) || char.charCodeAt(0) < 0x20 || char === '\x7f') {
+            return parseFailure('invalid-control-char', input, index, argv.length, 'cmd');
+        }
+        if (char === '"') {
+            tokenStarted = true;
+            quote = true;
+            continue;
+        }
+        if (char === '%' || char === '!') {
+            return parseFailure(char === '%' ? 'unsafe-expansion' : 'shell-composition', input, index, argv.length, 'cmd');
+        }
+        if (char === '^' || char === '&' || char === '|' || char === '<' || char === '>'
+            || char === ';' || char === '(' || char === ')' || char === '*' || char === '?'
+            || char === '[' || char === ']' || char === '{' || char === '}') {
+            return parseFailure('shell-composition', input, index, argv.length, 'cmd');
+        }
+        tokenStarted = true;
+        token += char;
+    }
+    if (quote)
+        return parseFailure('invalid-quote', input, input.length, argv.length, 'cmd');
+    finishToken();
+    return argv.length > 0
+        ? {
+            ok: true,
+            argv: options.allowManagedTmpDir
+                ? argv.map(value => restoreManagedTmpDirToken(value, options.managedTempDir))
+                : argv,
+        }
+        : parseFailure('empty-command', input, input.length, argv.length, 'cmd');
+}
+function isCodexCmdExecutable(value) {
+    if (!value)
+        return false;
+    const normalized = value.toLowerCase();
+    return CODEX_CMD_EXECUTABLES.has(normalized)
+        || CODEX_CMD_INSTALL_PATH_RE.test(value)
+        || isAbsoluteCustomShellPath(value, CODEX_CUSTOM_CMD_NAMES);
+}
+function resolveCodexCmdCarrierArgv(argv) {
+    if (argv.length < 3 || !isCodexCmdExecutable(argv[0]))
+        return undefined;
+    const executeIndex = argv.slice(1, -1).findIndex(value => value.toLowerCase() === '/c');
+    if (executeIndex < 0)
+        return undefined;
+    const absoluteExecuteIndex = executeIndex + 1;
+    // The command must remain one argv item. Joining multiple items would lose
+    // the quoting boundary that the Windows launcher actually executed.
+    if (absoluteExecuteIndex !== argv.length - 2)
+        return undefined;
+    const seen = new Set();
+    for (const rawSwitch of argv.slice(1, absoluteExecuteIndex)) {
+        const switchValue = rawSwitch.toLowerCase();
+        if (!CODEX_CMD_INERT_SWITCHES.has(switchValue) || seen.has(switchValue))
+            return undefined;
+        seen.add(switchValue);
+    }
+    const command = argv.at(-1);
+    return typeof command === 'string' && command.trim()
+        ? { command, dialect: 'cmd', executable: argv[0] }
+        : undefined;
+}
+/** Resolve a Windows cmd carrier when the app-server provides only a string. */
+function resolveCodexCmdCarrierString(command) {
+    const input = trimShellSpacing(command);
+    // The executable may be quoted when the app-server serializes a Windows
+    // path. Parse the prefix into argv-like switches, then use the same
+    // validation as the commandArgv path so both representations agree.
+    const match = input.match(/^(?:"([^"]+)"|(\S+))((?:\s+\/[^\s]+)*)\s+(.+)$/i);
+    if (!match)
+        return undefined;
+    const executable = match[1] ?? match[2];
+    const rawSwitches = match[3].trim();
+    const switches = rawSwitches ? rawSwitches.split(/[ \t]+/) : [];
+    const argv = [executable, ...switches, match[4]];
+    return resolveCodexCmdCarrierArgv(argv);
+}
+/** Resolve a PowerShell carrier when the app-server provides only a string. */
+function resolveCodexPowerShellCarrierString(command) {
+    const input = trimShellSpacing(command);
+    const match = input.match(/^(?:"([^"]+)"|(\S+))\s+-command\s+(.+)$/i);
+    if (!match)
+        return undefined;
+    const executable = match[1] ?? match[2];
+    if (!isCodexPowerShellExecutable(executable))
+        return undefined;
+    // A string-form carrier has one additional command-line quoting layer. The
+    // command argument is commonly serialized as `"ec ..."`; remove exactly
+    // that outer pair and leave quotes belonging to EC arguments intact.
+    let nested = match[3].trim();
+    if (nested.length >= 2
+        && ((nested.startsWith('"') && nested.endsWith('"'))
+            || (nested.startsWith("'") && nested.endsWith("'")))) {
+        nested = nested.slice(1, -1);
+    }
+    return nested ? { command: nested, dialect: 'powershell', executable } : undefined;
+}
+/** Resolve a POSIX shell carrier when app-server provides only a string. */
+function resolveCodexPosixShellCarrierString(command) {
+    const input = trimShellSpacing(command);
+    const match = input.match(/^(?:"([^"]+)"|(\S+))\s+(-lc|-c)\s+(.+)$/);
+    if (!match)
+        return undefined;
+    const executable = match[1] ?? match[2];
+    if (!isCodexPosixShellExecutable(executable))
+        return undefined;
+    // A string-form carrier has one additional command-line quoting layer. Strip
+    // only the outer pair; quotes belonging to the nested command remain intact.
+    let nested = match[4].trim();
+    if (nested.length >= 2
+        && ((nested.startsWith('"') && nested.endsWith('"'))
+            || (nested.startsWith("'") && nested.endsWith("'")))) {
+        nested = nested.slice(1, -1);
+    }
+    return nested ? { command: nested, dialect: 'posix', executable } : undefined;
+}
+export function resolveCodexShellCarrierString(command) {
+    return resolveCodexCmdCarrierString(command)
+        ?? resolveCodexPowerShellCarrierString(command)
+        ?? resolveCodexPosixShellCarrierString(command);
+}
+/**
+ * Extract a trusted cmd executable's command body without trusting its startup
+ * switches. This is used only to classify malformed EC carriers as a
+ * controlled denial; a command with a non-EC body remains an ordinary shell
+ * command and follows the normal approval path.
+ */
+function extractCodexCmdCarrierBody(command) {
+    const input = trimShellSpacing(command);
+    const match = input.match(/^(?:"([^"]+)"|(\S+))((?:\s+\/[^\s]+)*)\s+(.+)$/i);
+    if (!match)
+        return undefined;
+    const executable = match[1] ?? match[2];
+    if (!isCodexCmdExecutable(executable))
+        return undefined;
+    const body = match[4].trim();
+    return body || undefined;
+}
+function extractCodexCmdCarrierBodyArgv(argv) {
+    if (!argv.length || !isCodexCmdExecutable(argv[0]))
+        return undefined;
+    let bodyIndex = 1;
+    for (; bodyIndex < argv.length; bodyIndex++) {
+        const value = argv[bodyIndex];
+        if (value.toLowerCase() === '/c') {
+            bodyIndex++;
+            break;
+        }
+        // This is deliberately loose. It is only used to identify a malformed
+        // carrier that should be denied, never to authorize a command.
+        if (!value.startsWith('/'))
+            break;
+    }
+    const body = argv.slice(bodyIndex).join(' ').trim();
+    return body || undefined;
+}
+function looksLikeEcCommandBody(command) {
+    if (!command)
+        return false;
+    const input = command.trim();
+    const body = (input.startsWith('"') ? input.slice(1) : input).trimStart();
+    return /^ec(?:\.cmd|\.exe)?(?:\s|$)/i.test(body);
+}
+/** True only when a trusted cmd executable is carrying an EC command body. */
+export function hasCodexCmdCarrierEcIntent(input) {
+    if (Array.isArray(input.commandArgv)
+        && input.commandArgv.every(value => typeof value === 'string')) {
+        return looksLikeEcCommandBody(extractCodexCmdCarrierBodyArgv(input.commandArgv));
+    }
+    return typeof input.command === 'string'
+        && looksLikeEcCommandBody(extractCodexCmdCarrierBody(input.command));
+}
+function parseCodexCmdCarrierArgvFailure(argv) {
+    const body = extractCodexCmdCarrierBodyArgv(argv);
+    if (!body || !looksLikeEcCommandBody(body))
+        return undefined;
+    const nested = parseLiteralShellCommand(body, { dialect: 'cmd', allowManagedTmpDir: true });
+    if (!nested.ok)
+        return nested;
+    return parseFailure('shell-composition', body, 0, 0, 'cmd');
+}
+function parseCodexCmdCarrierStringFailure(command, options = {}) {
+    const body = extractCodexCmdCarrierBody(command);
+    if (!body || !looksLikeEcCommandBody(body))
+        return undefined;
+    const nested = parseLiteralShellCommand(body, {
+        ...options,
+        dialect: 'cmd',
+    });
+    return nested.ok
+        ? parseFailure('shell-composition', body, 0, 0, 'cmd')
+        : nested;
 }
 function doubleQuotedIssueAt(input, index) {
     const char = input[index];
@@ -262,13 +731,16 @@ export function parseLiteralShellCommand(command, options = {}) {
     if (options.dialect === 'powershell') {
         return parseLiteralPowerShellCommand(command);
     }
+    if (options.dialect === 'cmd') {
+        return parseLiteralCmdCommand(command, options);
+    }
     const input = trimShellSpacing(options.allowManagedTmpDir
         ? substituteManagedTmpDirToken(command)
         : command);
     if (!input)
-        return { ok: false, issue: 'empty-command' };
+        return parseFailure('empty-command', input, 0, 0, 'posix');
     if (input.includes('\0'))
-        return { ok: false, issue: 'invalid-control-char' };
+        return parseFailure('invalid-control-char', input, input.indexOf('\0'), 0, 'posix');
     const argv = [];
     let token = '';
     let tokenStarted = false;
@@ -285,7 +757,7 @@ export function parseLiteralShellCommand(command, options = {}) {
         if (quote === 'single') {
             if (char === "'") {
                 if (!isLiteralArgBoundary(input[index + 1]))
-                    return { ok: false, issue: 'invalid-quote' };
+                    return parseFailure('invalid-quote', input, index, argv.length, 'posix');
                 quote = null;
             }
             else
@@ -295,13 +767,13 @@ export function parseLiteralShellCommand(command, options = {}) {
         if (quote === 'double') {
             if (char === '"') {
                 if (!isLiteralArgBoundary(input[index + 1]))
-                    return { ok: false, issue: 'invalid-quote' };
+                    return parseFailure('invalid-quote', input, index, argv.length, 'posix');
                 quote = null;
                 continue;
             }
             const issue = doubleQuotedIssueAt(input, index);
             if (issue)
-                return { ok: false, issue };
+                return parseFailure(issue, input, index, argv.length, 'posix');
             if (char === '\\') {
                 const next = input[++index];
                 token += ['"', '\\', '$', '`'].includes(next) ? next : `\\${next}`;
@@ -321,9 +793,9 @@ export function parseLiteralShellCommand(command, options = {}) {
         // keeps inside the executable name; accepting those would misclassify a
         // different executable as `ec`.
         if (char === '\r' || char === '\n')
-            return { ok: false, issue: 'structural-newline' };
+            return parseFailure('structural-newline', input, index, argv.length, 'posix');
         if (/\s/u.test(char) || char.charCodeAt(0) < 0x20 || char === '\x7f') {
-            return { ok: false, issue: 'invalid-control-char' };
+            return parseFailure('invalid-control-char', input, index, argv.length, 'posix');
         }
         if (char === "'") {
             tokenStarted = true;
@@ -338,9 +810,9 @@ export function parseLiteralShellCommand(command, options = {}) {
         if (char === '\\') {
             const next = input[++index];
             if (next === undefined)
-                return { ok: false, issue: 'invalid-quote' };
+                return parseFailure('invalid-quote', input, index, argv.length, 'posix');
             if (next === '\r' || next === '\n')
-                return { ok: false, issue: 'structural-newline' };
+                return parseFailure('structural-newline', input, index, argv.length, 'posix');
             tokenStarted = true;
             token += next;
             continue;
@@ -349,12 +821,12 @@ export function parseLiteralShellCommand(command, options = {}) {
         // peer keys such as `aun#alice` are ordinary literal arguments.
         if ((SHELL_UNQUOTED_META.has(char) && (char !== '#' || !tokenStarted))
             || (char === '~' && !tokenStarted))
-            return { ok: false, issue: 'shell-composition' };
+            return parseFailure('shell-composition', input, index, argv.length, 'posix');
         tokenStarted = true;
         token += char;
     }
     if (quote)
-        return { ok: false, issue: 'invalid-quote' };
+        return parseFailure('invalid-quote', input, input.length, argv.length, 'posix');
     finishToken();
     return argv.length > 0
         ? {
@@ -363,24 +835,27 @@ export function parseLiteralShellCommand(command, options = {}) {
                 ? argv.map(value => restoreManagedTmpDirToken(value, options.managedTempDir))
                 : argv,
         }
-        : { ok: false, issue: 'empty-command' };
+        : parseFailure('empty-command', input, input.length, argv.length, 'posix');
 }
 export function parseLiteralShellArgv(command, options = {}) {
     const result = parseLiteralShellCommand(command, options);
     return result.ok ? result.argv : null;
 }
 export function resolveCodexShellCarrierArgv(argv) {
-    if (argv.length !== 3)
-        return undefined;
-    if (argv[1] === '-lc' && CODEX_POSIX_SHELL_EXECUTABLES.has(argv[0])) {
-        return { command: argv[2], dialect: 'posix' };
+    if (argv.length === 3
+        && (argv[1] === '-lc' || argv[1] === '-c')
+        && isCodexPosixShellExecutable(argv[0])) {
+        return { command: argv[2], dialect: 'posix', executable: argv[0] };
     }
-    const powershellExecutable = argv[0].toLowerCase();
-    const isPowerShell = CODEX_POWERSHELL_EXECUTABLES.has(powershellExecutable)
-        || CODEX_POWERSHELL_INSTALL_PATH_RE.test(argv[0]);
-    return isPowerShell && argv[1].toLowerCase() === '-command'
-        ? { command: argv[2], dialect: 'powershell' }
-        : undefined;
+    if (argv.length === 3) {
+        if (isCodexPowerShellExecutable(argv[0]) && argv[1].toLowerCase() === '-command') {
+            return { command: argv[2], dialect: 'powershell', executable: argv[0] };
+        }
+    }
+    // Node/cross-spawn and Codex use cmd.exe with a small set of startup flags.
+    // The execute switch must be the final switch before one command argument;
+    // validation itself is shared with string-only Windows payloads below.
+    return resolveCodexCmdCarrierArgv(argv);
 }
 export function unwrapCodexShellCommandArgv(argv) {
     return resolveCodexShellCarrierArgv(argv)?.command;
@@ -392,31 +867,70 @@ export function unwrapCodexShellCommandArgv(argv) {
  */
 export function parseCodexShellCommandArgv(command, options = {}) {
     const outer = parseLiteralShellArgv(command, options);
-    if (!outer)
+    if (outer) {
+        const carrier = resolveCodexShellCarrierArgv(outer);
+        if (carrier !== undefined) {
+            const parsed = parseCodexCarrierCommand(carrier, options);
+            return parsed.ok ? parsed.argv : null;
+        }
+        const stringCarrier = resolveCodexShellCarrierString(command);
+        if (stringCarrier) {
+            const parsed = parseCodexCarrierCommand(stringCarrier, options);
+            return parsed.ok ? parsed.argv : null;
+        }
+        if (parseCodexCmdCarrierStringFailure(command, options))
+            return null;
+        return normalizeEvolcoreCommandArgv(outer);
+    }
+    const stringCarrier = resolveCodexShellCarrierString(command);
+    if (!stringCarrier)
         return null;
-    const carrier = resolveCodexShellCarrierArgv(outer);
-    return carrier === undefined
-        ? outer
-        : parseLiteralShellArgv(carrier.command, { ...options, dialect: carrier.dialect });
+    const parsed = parseCodexCarrierCommand(stringCarrier, options);
+    return parsed.ok ? normalizeEvolcoreCommandArgv(parsed.argv) : null;
 }
-/**
- * Resolve a Codex command input while preserving the raw `commandArgv` form
- * supplied by app-server. Joining that argv with spaces loses the quoting of
- * the inner `-lc` command and was the source of a false proactive denial.
- */
-export function parseCodexToolCommandArgv(input) {
-    if (Array.isArray(input.commandArgv) && input.commandArgv.every(value => typeof value === 'string')) {
+/** Parse a Codex tool input while preserving safe syntax failure metadata. */
+export function parseCodexToolCommand(input, options = {}) {
+    if (Array.isArray(input.commandArgv)) {
+        if (!input.commandArgv.every(value => typeof value === 'string')) {
+            return parseFailure('invalid-control-char', '', 0, 0, 'posix');
+        }
         const outer = input.commandArgv;
+        const nulIndex = outer.findIndex(value => value.includes('\0'));
+        if (nulIndex >= 0)
+            return parseFailure('invalid-control-char', '', 0, nulIndex, 'posix');
         const carrier = resolveCodexShellCarrierArgv(outer);
-        return carrier === undefined
-            ? outer
-            : parseLiteralShellArgv(carrier.command, {
-                allowManagedTmpDir: true,
-                dialect: carrier.dialect,
-            });
+        if (carrier === undefined) {
+            return parseCodexCmdCarrierArgvFailure(outer)
+                ?? { ok: true, argv: normalizeEvolcoreCommandArgv(outer) };
+        }
+        return parseCodexCarrierCommand(carrier, { allowManagedTmpDir: true, ...options });
     }
     const command = typeof input.command === 'string' ? input.command : '';
-    return parseCodexShellCommandArgv(command, { allowManagedTmpDir: true });
+    const outer = parseLiteralShellCommand(command, { allowManagedTmpDir: true });
+    if (outer.ok) {
+        const carrier = resolveCodexShellCarrierArgv(outer.argv);
+        if (carrier !== undefined) {
+            return parseCodexCarrierCommand(carrier, { allowManagedTmpDir: true, ...options });
+        }
+        const stringCarrier = resolveCodexShellCarrierString(command);
+        return stringCarrier
+            ? parseCodexCarrierCommand(stringCarrier, { allowManagedTmpDir: true, ...options })
+            : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true })
+                ?? { ...outer, argv: normalizeEvolcoreCommandArgv(outer.argv) };
+    }
+    const stringCarrier = resolveCodexShellCarrierString(command);
+    return stringCarrier
+        ? parseCodexCarrierCommand(stringCarrier, { allowManagedTmpDir: true, ...options })
+        : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true }) ?? outer;
+}
+/**
+ * Resolve a Codex command input while preserving the raw `commandArgv` form
+ * supplied by app-server. Joining that argv with spaces loses the quoting of
+ * the inner `-c`/`-lc` command and was the source of a false proactive denial.
+ */
+export function parseCodexToolCommandArgv(input, options = {}) {
+    const result = parseCodexToolCommand(input, options);
+    return result.ok ? result.argv : null;
 }
 function isSimpleExecStringLiteral(value) {
     const quote = value[0];
@@ -903,12 +1417,15 @@ export function parseCodexExecToolCommand(input) {
     return decoded;
 }
 function parseProactiveToolCommandArgv(toolName, input) {
+    const options = {
+        verifyShellExecutable: process.platform === 'win32',
+    };
     if (toolName === 'Bash' || toolName === 'Shell')
-        return parseCodexToolCommandArgv(input);
+        return parseCodexToolCommandArgv(input, options);
     if (toolName !== 'exec')
         return null;
     const command = parseCodexExecToolCommand(input);
-    return command ? parseCodexShellCommandArgv(command, { allowManagedTmpDir: true }) : null;
+    return command ? parseCodexShellCommandArgv(command, { allowManagedTmpDir: true, ...options }) : null;
 }
 function scanBoundedOutputOperators(command) {
     const operators = [];
@@ -1099,23 +1616,62 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
     const parseOptions = { allowManagedTmpDir: true, ...options };
     const literal = parseLiteralShellCommand(command, parseOptions);
     if (literal.ok) {
-        if (literal.argv[0] === 'ec')
+        if (normalizeEvolcoreCommandArgv(literal.argv)[0] === 'ec')
             return { kind: 'literal' };
         const carrier = resolveCodexShellCarrierArgv(literal.argv);
         if (carrier !== undefined) {
-            const nested = parseLiteralShellCommand(carrier.command, {
-                ...parseOptions,
-                dialect: carrier.dialect,
-            });
+            const nested = parseCodexCarrierCommand(carrier, parseOptions);
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
-            if (!nested.ok && hasEcCommandPrefix(carrier.command)) {
+            if (!nested.ok && (hasCarrierEcCommandPrefix(carrier.command, carrier.dialect)
+                || (carrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(carrier.command)))) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
+        const stringCarrier = resolveCodexShellCarrierString(command);
+        if (stringCarrier) {
+            const nested = parseCodexCarrierCommand(stringCarrier, parseOptions);
+            if (nested.ok && nested.argv[0] === 'ec')
+                return { kind: 'literal' };
+            if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
+                || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
+                return { kind: 'composite', issue: nested.issue };
+            }
+        }
+        const malformedCmdBody = extractCodexCmdCarrierBody(command);
+        if (malformedCmdBody && looksLikeEcCommandBody(malformedCmdBody)) {
+            const nested = parseLiteralShellCommand(malformedCmdBody, {
+                ...parseOptions,
+                dialect: 'cmd',
+            });
+            return nested.ok
+                ? { kind: 'composite', issue: 'shell-composition' }
+                : { kind: 'composite', issue: nested.issue };
+        }
         return { kind: 'none' };
     }
-    const boundedOutput = options.dialect === 'powershell'
+    const stringCarrier = resolveCodexShellCarrierString(command);
+    if (stringCarrier) {
+        const nested = parseCodexCarrierCommand(stringCarrier, parseOptions);
+        if (nested.ok && nested.argv[0] === 'ec')
+            return { kind: 'literal' };
+        if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
+            || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
+            return { kind: 'composite', issue: nested.issue };
+        }
+        return { kind: 'none' };
+    }
+    const malformedCmdBody = extractCodexCmdCarrierBody(command);
+    if (malformedCmdBody && looksLikeEcCommandBody(malformedCmdBody)) {
+        const nested = parseLiteralShellCommand(malformedCmdBody, {
+            ...parseOptions,
+            dialect: 'cmd',
+        });
+        return nested.ok
+            ? { kind: 'composite', issue: 'shell-composition' }
+            : { kind: 'composite', issue: nested.issue };
+    }
+    const boundedOutput = options.dialect === 'powershell' || options.dialect === 'cmd'
         ? null
         : parseBoundedOutputShellCommand(command);
     if (boundedOutput && boundedOutput.argv[0] === 'ec') {
@@ -1331,7 +1887,9 @@ export function parseEvolcoreSendCommand(command) {
 export function isEvolcoreSendCommandForSession(toolName, input, channelId) {
     if (toolName !== 'Bash')
         return false;
-    const argv = parseCodexToolCommandArgv(input);
+    const argv = parseCodexToolCommandArgv(input, {
+        verifyShellExecutable: process.platform === 'win32',
+    });
     const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
     if (!parsed)
         return false;