evolcore 0.0.21 → 0.0.22

package/dist/core/permission/ec-command-parser.js

@@ -1,15 +1,19 @@
+import { isTrustedWindowsShellExecutable } from '../../utils/windows-shell-trust.js';
 const HEAD_EXECUTABLES = new Set(['head', '/bin/head', '/usr/bin/head']);
 // Codex app-server sends command executions through a fixed shell carrier.
 // Treat the carrier as syntax only after parsing it as literal argv; never
 // accept an arbitrary shell command string or unwrap composition here.
 const CODEX_POSIX_SHELL_EXECUTABLES = new Set([
-    'bash', '/bin/bash', '/usr/bin/bash',
-    'sh', '/bin/sh', '/usr/bin/sh',
+    'bash', 'bash.exe', '/bin/bash', '/usr/bin/bash',
+    'sh', 'sh.exe', '/bin/sh', '/usr/bin/sh',
 ]);
 const CODEX_POWERSHELL_EXECUTABLES = new Set([
     'pwsh', 'pwsh.exe', 'powershell', 'powershell.exe',
 ]);
 const CODEX_POWERSHELL_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Program Files[\\/]PowerShell[\\/][0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9.-]+)?[\\/]pwsh\.exe|Windows[\\/]System32[\\/]WindowsPowerShell[\\/]v1\.0[\\/]powershell\.exe)$/i;
+const CODEX_CUSTOM_POSIX_SHELL_NAMES = new Set(['bash', 'bash.exe', 'sh', 'sh.exe']);
+const CODEX_CUSTOM_POWERSHELL_NAMES = new Set(['pwsh.exe', 'powershell.exe']);
+const CODEX_CUSTOM_CMD_NAMES = new Set(['cmd.exe']);
 const CODEX_CMD_EXECUTABLES = new Set(['cmd', 'cmd.exe']);
 const CODEX_CMD_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Windows[\\/](?:System32|SysWOW64|Sysnative)[\\/]cmd\.exe)$/i;
 // These switches affect only cmd startup/output formatting. `/c` is handled
@@ -17,6 +21,12 @@ const CODEX_CMD_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Windows[\\/](?:System32|Sys
 // `/e:*`, and `/f:*` can change process lifetime or command semantics and are
 // intentionally not treated as a trusted Codex carrier.
 const CODEX_CMD_INERT_SWITCHES = new Set(['/d', '/s', '/q', '/a', '/u']);
+const EVOLCORE_EXECUTABLE_ALIASES = new Set(['ec', 'ec.cmd', 'ec.exe']);
+const EVOLCORE_NODE_EXECUTABLES = new Set(['node', 'node.exe']);
+// Development/install entrypoints that are part of this repository's CLI.
+// Only these exact relative paths are canonicalized; arbitrary Node scripts
+// must never become an EC command merely because their filename is similar.
+const EVOLCORE_NODE_WRAPPER_PATHS = new Set(['bin/ec.js', 'dist/cli/index.js']);
 const SHELL_UNQUOTED_META = new Set([
     ';', '&', '|', '`', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#',
 ]);
@@ -68,8 +78,7 @@ function hasEcCommandPrefix(command) {
         }
         if (boundary && /\s/.test(char))
             continue;
-        if (boundary && command.slice(index, index + 2).toLowerCase() === 'ec'
-            && (index + 2 === command.length || /\s|[;&|`()<>]/.test(command[index + 2])))
+        if (boundary && /^ec(?:\.cmd|\.exe)?(?=$|\s|[;&|`()<>])/i.test(command.slice(index)))
             return true;
         boundary = false;
     }
@@ -78,6 +87,45 @@ function hasEcCommandPrefix(command) {
 function trimShellSpacing(value) {
     return value.replace(/^[ \t]+|[ \t]+$/g, '');
 }
+/**
+ * Accept an explicitly materialized absolute shell path, including Windows
+ * Store/App Execution Alias paths such as `...\\WindowsApps\\pwsh.exe`.
+ * Relative names remain restricted to the fixed executable allowlists above.
+ */
+function isAbsoluteCustomShellPath(value, executableNames) {
+    if (!value || /[\0\r\n"'<>|?*]/.test(value))
+        return false;
+    const normalized = value.replaceAll('\\', '/');
+    if (!/^[A-Za-z]:\//.test(normalized) && !normalized.startsWith('//'))
+        return false;
+    const basename = normalized.slice(normalized.lastIndexOf('/') + 1).toLowerCase();
+    return executableNames.has(basename);
+}
+function isNodeExecutable(value) {
+    if (!value)
+        return false;
+    const normalized = value.toLowerCase();
+    return EVOLCORE_NODE_EXECUTABLES.has(normalized)
+        || isAbsoluteCustomShellPath(value, EVOLCORE_NODE_EXECUTABLES);
+}
+function normalizeNodeWrapperPath(value) {
+    const normalized = value.replaceAll('\\', '/').replace(/^\.\//, '').toLowerCase();
+    return EVOLCORE_NODE_WRAPPER_PATHS.has(normalized) ? normalized : undefined;
+}
+function isCodexPosixShellExecutable(value) {
+    if (!value)
+        return false;
+    return CODEX_POSIX_SHELL_EXECUTABLES.has(value.toLowerCase())
+        || isAbsoluteCustomShellPath(value, CODEX_CUSTOM_POSIX_SHELL_NAMES);
+}
+function isCodexPowerShellExecutable(value) {
+    if (!value)
+        return false;
+    const normalized = value.toLowerCase();
+    return CODEX_POWERSHELL_EXECUTABLES.has(normalized)
+        || CODEX_POWERSHELL_INSTALL_PATH_RE.test(value)
+        || isAbsoluteCustomShellPath(value, CODEX_CUSTOM_POWERSHELL_NAMES);
+}
 const MANAGED_TMPDIR_TOKEN = '__EC_MANAGED_TMPDIR__';
 /**
  * Preserve the one environment reference allowed in managed EC paths.
@@ -154,7 +202,155 @@ function hasCarrierEcCommandPrefix(command, dialect) {
     const inner = input.length >= 2 && input.startsWith('"') && input.endsWith('"')
         ? input.slice(1, -1)
         : input;
-    return /^\s*ec(?:\s|$)/i.test(inner);
+    return /^\s*ec(?:\.cmd|\.exe)?(?:\s|$)/i.test(inner);
+}
+/** Normalize the Windows npm shims to the canonical EvolCore CLI name. */
+export function normalizeEvolcoreCommandArgv(argv) {
+    if (argv.length === 0)
+        return [];
+    const executable = argv[0];
+    if (typeof executable === 'string' && EVOLCORE_EXECUTABLE_ALIASES.has(executable.toLowerCase())) {
+        return ['ec', ...argv.slice(1)];
+    }
+    if (typeof executable === 'string' && isNodeExecutable(executable) && argv.length >= 2
+        && typeof argv[1] === 'string' && normalizeNodeWrapperPath(argv[1])) {
+        return ['ec', ...argv.slice(2)];
+    }
+    return [...argv];
+}
+/** Detect the historical PowerShell pattern that overwrote the thread carrier. */
+export function hasPowerShellDelegationAssignment(command) {
+    return /^\s*\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(command)
+        && /\bec(?:\.cmd|\.exe)?(?:\s|$)/i.test(command);
+}
+/**
+ * Windows Codex may materialize one environment variable assignment directly
+ * in the PowerShell command body instead of inheriting it from the process
+ * environment. Only the EvolCore delegation variable is accepted, and only
+ * when followed by one command on the same carrier. The value is validated for
+ * shape but never trusted for authorization; the runner still arms the stable
+ * in-memory thread carrier.
+ */
+function unwrapPowerShellDelegationPrefix(command) {
+    const input = command.trim();
+    if (!/^\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(input)) {
+        return { kind: 'none', command };
+    }
+    let index = 0;
+    const skipSpace = () => {
+        while (index < input.length && (input[index] === ' ' || input[index] === '\t'))
+            index++;
+    };
+    const consume = (value) => {
+        if (input.slice(index, index + value.length).toLowerCase() !== value.toLowerCase())
+            return false;
+        index += value.length;
+        return true;
+    };
+    skipSpace();
+    if (!consume('$env') || input[index] !== ':')
+        return { kind: 'invalid', command };
+    index++;
+    skipSpace();
+    if (!consume('EVOLCORE_DELEGATION_TOKEN'))
+        return { kind: 'invalid', command };
+    skipSpace();
+    if (input[index] !== '=')
+        return { kind: 'invalid', command };
+    index++;
+    skipSpace();
+    const quote = input[index];
+    if (quote !== "'" && quote !== '"')
+        return { kind: 'invalid', command };
+    const valueStart = index++;
+    let value = '';
+    let closed = false;
+    // When the complete -Command body is itself single-quoted, command-line
+    // serialization can leave the assignment value in a doubled `''token''`
+    // form. Its token alphabet cannot contain quotes, so this exact shape is
+    // unambiguous and can be decoded without executing PowerShell grammar.
+    if (quote === "'" && input[valueStart + 1] === "'") {
+        const contentStart = valueStart + 2;
+        const end = input.indexOf("''", contentStart);
+        if (end < contentStart)
+            return { kind: 'invalid', command };
+        value = input.slice(contentStart, end);
+        index = end + 2;
+        closed = true;
+    }
+    while (index < input.length) {
+        if (closed)
+            break;
+        const char = input[index];
+        if (char === quote) {
+            // PowerShell single-quoted strings escape a quote as `''`. For the
+            // delegation token alphabet this is not needed, but accepting it lets us
+            // decode the doubled-quote form emitted by powershell.exe argv quoting.
+            if (quote === "'" && input[index + 1] === "'") {
+                value += "'";
+                index += 2;
+                continue;
+            }
+            index++;
+            closed = true;
+            break;
+        }
+        if (quote === '"' && char === '`')
+            return { kind: 'invalid', command };
+        if (char === '\r' || char === '\n')
+            return { kind: 'invalid', command };
+        value += char;
+        index++;
+    }
+    if (!closed || index <= valueStart + 1 || !/^[A-Za-z0-9_-]{32,128}$/.test(value)) {
+        return { kind: 'invalid', command };
+    }
+    if (input[index] !== ';')
+        return { kind: 'invalid', command };
+    index++;
+    const remainder = input.slice(index).trim();
+    if (!remainder)
+        return { kind: 'invalid', command };
+    return { kind: 'valid', command: remainder, token: value };
+}
+export function parseCodexCarrierCommand(carrier, options = {}) {
+    if (options.verifyShellExecutable) {
+        if (!carrier.executable) {
+            return parseFailure('untrusted-shell', carrier.command, 0, 0, carrier.dialect);
+        }
+        const kind = carrier.dialect === 'posix' ? 'bash' : carrier.dialect;
+        if (!isTrustedWindowsShellExecutable(carrier.executable, kind)) {
+            return parseFailure('untrusted-shell', carrier.command, 0, 0, carrier.dialect);
+        }
+    }
+    const unwrapped = carrier.dialect === 'powershell'
+        ? unwrapPowerShellDelegationPrefix(carrier.command)
+        : { kind: 'none', command: carrier.command };
+    // Windows PowerShell may materialize the thread's shell environment as a
+    // single `$env:EVOLCORE_DELEGATION_TOKEN = '...'` prefix. Keep the token as
+    // metadata for the approval layer, which must compare it with the runner's
+    // in-memory carrier before arming delegation. Malformed or unrelated
+    // assignments remain syntax failures and can never be authorized.
+    if (unwrapped.kind === 'invalid'
+        || (carrier.dialect === 'powershell'
+            && hasPowerShellDelegationAssignment(carrier.command)
+            && unwrapped.kind === 'none')
+        || (unwrapped.kind === 'valid'
+            && options.expectedDelegationToken !== undefined
+            && options.expectedDelegationToken !== unwrapped.token)) {
+        return parseFailure('shell-composition', carrier.command, 0, 0, carrier.dialect);
+    }
+    const parsed = parseLiteralShellCommand(unwrapped.command, {
+        ...options,
+        dialect: carrier.dialect,
+    });
+    return parsed.ok
+        ? {
+            ...parsed,
+            argv: normalizeEvolcoreCommandArgv(parsed.argv),
+            ...(unwrapped.kind === 'valid' ? { delegationToken: unwrapped.token } : {}),
+        }
+        : parsed;
 }
 function parseFailure(issue, input, offset, tokenIndex, dialect) {
     return {
@@ -355,7 +551,9 @@ function isCodexCmdExecutable(value) {
     if (!value)
         return false;
     const normalized = value.toLowerCase();
-    return CODEX_CMD_EXECUTABLES.has(normalized) || CODEX_CMD_INSTALL_PATH_RE.test(value);
+    return CODEX_CMD_EXECUTABLES.has(normalized)
+        || CODEX_CMD_INSTALL_PATH_RE.test(value)
+        || isAbsoluteCustomShellPath(value, CODEX_CUSTOM_CMD_NAMES);
 }
 function resolveCodexCmdCarrierArgv(argv) {
     if (argv.length < 3 || !isCodexCmdExecutable(argv[0]))
@@ -377,7 +575,7 @@ function resolveCodexCmdCarrierArgv(argv) {
     }
     const command = argv.at(-1);
     return typeof command === 'string' && command.trim()
-        ? { command, dialect: 'cmd' }
+        ? { command, dialect: 'cmd', executable: argv[0] }
         : undefined;
 }
 /** Resolve a Windows cmd carrier when the app-server provides only a string. */
@@ -402,10 +600,7 @@ function resolveCodexPowerShellCarrierString(command) {
     if (!match)
         return undefined;
     const executable = match[1] ?? match[2];
-    const normalized = executable.toLowerCase();
-    const isPowerShell = CODEX_POWERSHELL_EXECUTABLES.has(normalized)
-        || CODEX_POWERSHELL_INSTALL_PATH_RE.test(executable);
-    if (!isPowerShell)
+    if (!isCodexPowerShellExecutable(executable))
         return undefined;
     // A string-form carrier has one additional command-line quoting layer. The
     // command argument is commonly serialized as `"ec ..."`; remove exactly
@@ -416,11 +611,31 @@ function resolveCodexPowerShellCarrierString(command) {
             || (nested.startsWith("'") && nested.endsWith("'")))) {
         nested = nested.slice(1, -1);
     }
-    return nested ? { command: nested, dialect: 'powershell' } : undefined;
+    return nested ? { command: nested, dialect: 'powershell', executable } : undefined;
+}
+/** Resolve a POSIX shell carrier when app-server provides only a string. */
+function resolveCodexPosixShellCarrierString(command) {
+    const input = trimShellSpacing(command);
+    const match = input.match(/^(?:"([^"]+)"|(\S+))\s+(-lc|-c)\s+(.+)$/);
+    if (!match)
+        return undefined;
+    const executable = match[1] ?? match[2];
+    if (!isCodexPosixShellExecutable(executable))
+        return undefined;
+    // A string-form carrier has one additional command-line quoting layer. Strip
+    // only the outer pair; quotes belonging to the nested command remain intact.
+    let nested = match[4].trim();
+    if (nested.length >= 2
+        && ((nested.startsWith('"') && nested.endsWith('"'))
+            || (nested.startsWith("'") && nested.endsWith("'")))) {
+        nested = nested.slice(1, -1);
+    }
+    return nested ? { command: nested, dialect: 'posix', executable } : undefined;
 }
 export function resolveCodexShellCarrierString(command) {
     return resolveCodexCmdCarrierString(command)
-        ?? resolveCodexPowerShellCarrierString(command);
+        ?? resolveCodexPowerShellCarrierString(command)
+        ?? resolveCodexPosixShellCarrierString(command);
 }
 /**
  * Extract a trusted cmd executable's command body without trusting its startup
@@ -462,7 +677,7 @@ function looksLikeEcCommandBody(command) {
         return false;
     const input = command.trim();
     const body = (input.startsWith('"') ? input.slice(1) : input).trimStart();
-    return /^ec(?:\s|$)/i.test(body);
+    return /^ec(?:\.cmd|\.exe)?(?:\s|$)/i.test(body);
 }
 /** True only when a trusted cmd executable is carrying an EC command body. */
 export function hasCodexCmdCarrierEcIntent(input) {
@@ -627,15 +842,14 @@ export function parseLiteralShellArgv(command, options = {}) {
     return result.ok ? result.argv : null;
 }
 export function resolveCodexShellCarrierArgv(argv) {
-    if (argv.length === 3 && argv[1] === '-lc' && CODEX_POSIX_SHELL_EXECUTABLES.has(argv[0])) {
-        return { command: argv[2], dialect: 'posix' };
+    if (argv.length === 3
+        && (argv[1] === '-lc' || argv[1] === '-c')
+        && isCodexPosixShellExecutable(argv[0])) {
+        return { command: argv[2], dialect: 'posix', executable: argv[0] };
     }
     if (argv.length === 3) {
-        const powershellExecutable = argv[0].toLowerCase();
-        const isPowerShell = CODEX_POWERSHELL_EXECUTABLES.has(powershellExecutable)
-            || CODEX_POWERSHELL_INSTALL_PATH_RE.test(argv[0]);
-        if (isPowerShell && argv[1].toLowerCase() === '-command') {
-            return { command: argv[2], dialect: 'powershell' };
+        if (isCodexPowerShellExecutable(argv[0]) && argv[1].toLowerCase() === '-command') {
+            return { command: argv[2], dialect: 'powershell', executable: argv[0] };
         }
     }
     // Node/cross-spawn and Codex use cmd.exe with a small set of startup flags.
@@ -656,27 +870,26 @@ export function parseCodexShellCommandArgv(command, options = {}) {
     if (outer) {
         const carrier = resolveCodexShellCarrierArgv(outer);
         if (carrier !== undefined) {
-            return parseLiteralShellArgv(carrier.command, { ...options, dialect: carrier.dialect });
+            const parsed = parseCodexCarrierCommand(carrier, options);
+            return parsed.ok ? parsed.argv : null;
         }
         const stringCarrier = resolveCodexShellCarrierString(command);
         if (stringCarrier) {
-            return parseLiteralShellArgv(stringCarrier.command, { ...options, dialect: stringCarrier.dialect });
+            const parsed = parseCodexCarrierCommand(stringCarrier, options);
+            return parsed.ok ? parsed.argv : null;
         }
         if (parseCodexCmdCarrierStringFailure(command, options))
             return null;
-        return outer;
+        return normalizeEvolcoreCommandArgv(outer);
     }
     const stringCarrier = resolveCodexShellCarrierString(command);
     if (!stringCarrier)
         return null;
-    const parsed = parseLiteralShellCommand(stringCarrier.command, {
-        ...options,
-        dialect: stringCarrier.dialect,
-    });
-    return parsed.ok ? parsed.argv : null;
+    const parsed = parseCodexCarrierCommand(stringCarrier, options);
+    return parsed.ok ? normalizeEvolcoreCommandArgv(parsed.argv) : null;
 }
 /** Parse a Codex tool input while preserving safe syntax failure metadata. */
-export function parseCodexToolCommand(input) {
+export function parseCodexToolCommand(input, options = {}) {
     if (Array.isArray(input.commandArgv)) {
         if (!input.commandArgv.every(value => typeof value === 'string')) {
             return parseFailure('invalid-control-char', '', 0, 0, 'posix');
@@ -687,46 +900,36 @@ export function parseCodexToolCommand(input) {
             return parseFailure('invalid-control-char', '', 0, nulIndex, 'posix');
         const carrier = resolveCodexShellCarrierArgv(outer);
         if (carrier === undefined) {
-            return parseCodexCmdCarrierArgvFailure(outer) ?? { ok: true, argv: outer };
+            return parseCodexCmdCarrierArgvFailure(outer)
+                ?? { ok: true, argv: normalizeEvolcoreCommandArgv(outer) };
         }
-        return parseLiteralShellCommand(carrier.command, {
-            allowManagedTmpDir: true,
-            dialect: carrier.dialect,
-        });
+        return parseCodexCarrierCommand(carrier, { allowManagedTmpDir: true, ...options });
     }
     const command = typeof input.command === 'string' ? input.command : '';
     const outer = parseLiteralShellCommand(command, { allowManagedTmpDir: true });
     if (outer.ok) {
         const carrier = resolveCodexShellCarrierArgv(outer.argv);
         if (carrier !== undefined) {
-            return parseLiteralShellCommand(carrier.command, {
-                allowManagedTmpDir: true,
-                dialect: carrier.dialect,
-            });
+            return parseCodexCarrierCommand(carrier, { allowManagedTmpDir: true, ...options });
         }
         const stringCarrier = resolveCodexShellCarrierString(command);
         return stringCarrier
-            ? parseLiteralShellCommand(stringCarrier.command, {
-                allowManagedTmpDir: true,
-                dialect: stringCarrier.dialect,
-            })
-            : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true }) ?? outer;
+            ? parseCodexCarrierCommand(stringCarrier, { allowManagedTmpDir: true, ...options })
+            : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true })
+                ?? { ...outer, argv: normalizeEvolcoreCommandArgv(outer.argv) };
     }
     const stringCarrier = resolveCodexShellCarrierString(command);
     return stringCarrier
-        ? parseLiteralShellCommand(stringCarrier.command, {
-            allowManagedTmpDir: true,
-            dialect: stringCarrier.dialect,
-        })
+        ? parseCodexCarrierCommand(stringCarrier, { allowManagedTmpDir: true, ...options })
         : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true }) ?? outer;
 }
 /**
  * Resolve a Codex command input while preserving the raw `commandArgv` form
  * supplied by app-server. Joining that argv with spaces loses the quoting of
- * the inner `-lc` command and was the source of a false proactive denial.
+ * the inner `-c`/`-lc` command and was the source of a false proactive denial.
  */
-export function parseCodexToolCommandArgv(input) {
-    const result = parseCodexToolCommand(input);
+export function parseCodexToolCommandArgv(input, options = {}) {
+    const result = parseCodexToolCommand(input, options);
     return result.ok ? result.argv : null;
 }
 function isSimpleExecStringLiteral(value) {
@@ -1214,12 +1417,15 @@ export function parseCodexExecToolCommand(input) {
     return decoded;
 }
 function parseProactiveToolCommandArgv(toolName, input) {
+    const options = {
+        verifyShellExecutable: process.platform === 'win32',
+    };
     if (toolName === 'Bash' || toolName === 'Shell')
-        return parseCodexToolCommandArgv(input);
+        return parseCodexToolCommandArgv(input, options);
     if (toolName !== 'exec')
         return null;
     const command = parseCodexExecToolCommand(input);
-    return command ? parseCodexShellCommandArgv(command, { allowManagedTmpDir: true }) : null;
+    return command ? parseCodexShellCommandArgv(command, { allowManagedTmpDir: true, ...options }) : null;
 }
 function scanBoundedOutputOperators(command) {
     const operators = [];
@@ -1410,29 +1616,25 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
     const parseOptions = { allowManagedTmpDir: true, ...options };
     const literal = parseLiteralShellCommand(command, parseOptions);
     if (literal.ok) {
-        if (literal.argv[0] === 'ec')
+        if (normalizeEvolcoreCommandArgv(literal.argv)[0] === 'ec')
             return { kind: 'literal' };
         const carrier = resolveCodexShellCarrierArgv(literal.argv);
         if (carrier !== undefined) {
-            const nested = parseLiteralShellCommand(carrier.command, {
-                ...parseOptions,
-                dialect: carrier.dialect,
-            });
+            const nested = parseCodexCarrierCommand(carrier, parseOptions);
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
-            if (!nested.ok && hasCarrierEcCommandPrefix(carrier.command, carrier.dialect)) {
+            if (!nested.ok && (hasCarrierEcCommandPrefix(carrier.command, carrier.dialect)
+                || (carrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(carrier.command)))) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
         const stringCarrier = resolveCodexShellCarrierString(command);
         if (stringCarrier) {
-            const nested = parseLiteralShellCommand(stringCarrier.command, {
-                ...parseOptions,
-                dialect: stringCarrier.dialect,
-            });
+            const nested = parseCodexCarrierCommand(stringCarrier, parseOptions);
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
-            if (!nested.ok && hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)) {
+            if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
+                || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
@@ -1450,13 +1652,11 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
     }
     const stringCarrier = resolveCodexShellCarrierString(command);
     if (stringCarrier) {
-        const nested = parseLiteralShellCommand(stringCarrier.command, {
-            ...parseOptions,
-            dialect: stringCarrier.dialect,
-        });
+        const nested = parseCodexCarrierCommand(stringCarrier, parseOptions);
         if (nested.ok && nested.argv[0] === 'ec')
             return { kind: 'literal' };
-        if (!nested.ok && hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)) {
+        if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
+            || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
             return { kind: 'composite', issue: nested.issue };
         }
         return { kind: 'none' };
@@ -1687,7 +1887,9 @@ export function parseEvolcoreSendCommand(command) {
 export function isEvolcoreSendCommandForSession(toolName, input, channelId) {
     if (toolName !== 'Bash')
         return false;
-    const argv = parseCodexToolCommandArgv(input);
+    const argv = parseCodexToolCommandArgv(input, {
+        verifyShellExecutable: process.platform === 'win32',
+    });
     const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
     if (!parsed)
         return false;

package/dist/core/permission/protected-paths.js

@@ -268,21 +268,21 @@ export function getHClassSandboxPatterns(root = resolveRoot()) {
         '.lock',
         'daemon.pid',
         path.join('data', 'causation-aun.json*'),
-        path.join('data', 'triggers', '**'),
-        path.join('data', 'sessions', '**'),
+        path.join('data', 'triggers') + '/**',
+        path.join('data', 'sessions') + '/**',
         path.join('data', 'contact-book-audit.jsonl'),
         path.join('data', 'feishu-seen-*.jsonl'),
         path.join('data', '*-greeted-*.jsonl'),
         path.join('data', 'message-queue.json*'),
         path.join('data', 'daemon', 'message-queue.json*'),
-        path.join('data', 'daemon', 'control', '**'),
-        path.join('data', 'daemon', 'migrations', '**'),
-        path.join('data', 'channel-state', '**'),
+        path.join('data', 'daemon', 'control') + '/**',
+        path.join('data', 'daemon', 'migrations') + '/**',
+        path.join('data', 'channel-state') + '/**',
         path.join('data', 'instance', 'control.token'),
         path.join('data', 'outbox'),
-        path.join('data', 'outbox', '**'),
+        path.join('data', 'outbox') + '/**',
         path.join('data', 'handoff'),
-        path.join('data', 'handoff', '**'),
+        path.join('data', 'handoff') + '/**',
         path.join('agents', '*', 'sessions', '**'),
         path.join('agents', '*', 'data', 'channels', '**'),
         path.join('agents', '*', 'data', 'handoff', '**'),
@@ -296,8 +296,8 @@ export function getLClassWritePatterns(root = resolveRoot()) {
     const absoluteRoot = resolveThroughExistingAncestor(root);
     return [
         path.join(absoluteRoot, 'agents', '*', 'triggers'),
-        path.join(absoluteRoot, 'agents', '*', 'triggers', '**'),
-        path.join(absoluteRoot, 'agents', '*', 'roles', '**'),
+        path.join(absoluteRoot, 'agents', '*', 'triggers') + '/**',
+        path.join(absoluteRoot, 'agents', '*', 'roles') + '/**',
     ];
 }
 const CLAUDE_PROTECTED_TARGET_LIMIT = 8192;
@@ -451,7 +451,8 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
                 lClassRules[target.path] = lClassAccess;
             }
             if (expandLClassReadDeny || !options.denyLClassRead) {
-                lClassRules[path.join(target.path, '**')] = lClassAccess;
+                // Use '/**' suffix instead of path.join to satisfy Codex's glob requirement
+                lClassRules[target.path + '/**'] = lClassAccess;
             }
         }
         else {

package/dist/core/permission/tool-error-code.js

@@ -14,6 +14,18 @@ export function classifyToolErrorCode(input) {
     const explicit = normalizeToolErrorCode(input.errorCode);
     if (explicit)
         return explicit;
+    if (input.decisionSource === 'policy')
+        return 'POLICY_DENIED';
+    if (input.decisionSource === 'approval')
+        return 'USER_DENIED';
+    return 'EXECUTION_FAILED';
+}
+/**
+ * Compatibility classifier for historical, unstructured logs only.
+ * Production event producers must use classifyToolErrorCode() and explicit
+ * errorCode/decisionSource fields instead of interpreting command output.
+ */
+export function classifyLegacyToolErrorText(input) {
     const text = [input.error, input.result]
         .map(value => {
         if (typeof value === 'string')