evolcore 0.0.21 → 0.0.23

package/dist/core/permission/approval-gateway.js

@@ -3,7 +3,7 @@ import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
 import { renderActionAsText } from '../interaction-router.js';
 import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from '../message/message-utils.js';
 import { logger } from '../../utils/logger.js';
-import { summarizeToolInput } from '../../utils/tool-summary.js';
+import { summarizeToolInput, summarizeToolInputForAudit } from '../../utils/tool-summary.js';
 import { createRootCausation, deriveCausation, normalizeCausation } from '../causation/context.js';
 import { recordCausationSpan } from '../causation/audit.js';
 import { checkDangerousCommand } from './tool-policy.js';
@@ -31,6 +31,7 @@ export async function requestDangerousCommandPermission(gateway, sessionId, tool
             agentName: context?.agentName,
             role: context?.role,
             taskId: context?.taskId,
+            summary: summarizeToolInputForAudit(toolName, input).slice(0, 512),
         });
         return { matched: true, decision: 'deny' };
     }
@@ -132,6 +133,7 @@ function truncateApprovalDetail(value) {
         ? `${trimmed.slice(0, APPROVAL_DETAIL_LIMIT - 3)}...`
         : trimmed;
 }
+/** Keep unattended execution anomalies useful without copying command values. */
 function structuredApprovalAuditSummary(input) {
     const fields = [...new Set(Object.keys(input)
             .map(key => key.replace(/[^A-Za-z0-9_.-]/g, '_').slice(0, 48))
@@ -459,6 +461,7 @@ export class PermissionGateway {
                 agentName: pending.agentName,
                 role: pending.role,
                 taskId: pending.taskId,
+                summary: pending.auditSummary,
             });
         }
         void this.notifyPermissionState(pending, approved
@@ -511,6 +514,7 @@ export class PermissionGateway {
             agentName: pending.agentName,
             role: pending.role,
             taskId: pending.taskId,
+            summary: pending.auditSummary,
         });
         if (notifyState) {
             const failure = permissionFailure(reason);
@@ -558,6 +562,7 @@ export class PermissionGateway {
     async requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation, grantMatch) {
         const approval = context.approvalRouting;
         const interactionRouter = context.interactionRouter;
+        const auditSummary = summarizeToolInputForAudit(challenge.toolName, challenge.toolInput).slice(0, 512);
         if (!approval || !interactionRouter) {
             await sendPrompt('当前会话权限不足，且没有可用的 owner 审批通道。');
             auditPermissionDecision({
@@ -571,6 +576,7 @@ export class PermissionGateway {
                 agentName: context.agentName,
                 role: context.role,
                 taskId: context.taskId,
+                summary: structuredApprovalAuditSummary(challenge.toolInput),
             });
             return 'deny';
         }
@@ -673,6 +679,7 @@ export class PermissionGateway {
                 interactionRouter,
                 causation: requestCausation,
                 permissionStateChanged: context.permissionStateChanged,
+                auditSummary,
             };
             this.crossSessionPending.set(requestId, pending);
             this.syncManagementRevalidationTimer();
@@ -788,6 +795,7 @@ export class PermissionGateway {
             agentName: pending.agentName,
             role: pending.role,
             taskId: pending.taskId,
+            summary: pending.auditSummary,
         });
         const decisionCausation = deriveCausation(pending.causation);
         recordCausationSpan(decisionCausation, 'permission.decision', {
@@ -815,6 +823,7 @@ export class PermissionGateway {
         const effectiveApproverPolicy = approverPolicy
             ?? context?.approvalRouting?.approverPolicy
             ?? 'requester';
+        const auditSummary = summarizeToolInputForAudit(toolName, toolInput).slice(0, 512);
         if (context?.approvalInteractionPolicy === 'deny') {
             const denialRequestId = `perm-policy-${randomUUID()}`;
             const anomaly = {
@@ -852,6 +861,7 @@ export class PermissionGateway {
                 agentName: context.agentName,
                 role: context.role,
                 taskId: context.taskId,
+                summary: auditSummary,
             });
             return 'deny';
         }
@@ -868,6 +878,7 @@ export class PermissionGateway {
                 agentName: context?.agentName,
                 role: context?.role,
                 taskId: context?.taskId,
+                summary: auditSummary,
             });
             return 'deny';
         }
@@ -942,6 +953,7 @@ export class PermissionGateway {
                 agentName: context.agentName,
                 role: context.role,
                 taskId: context.taskId,
+                summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
             });
             return 'deny';
         }
@@ -1006,6 +1018,7 @@ export class PermissionGateway {
                 permissionMode: context?.permissionMode,
                 role: context?.role,
                 taskId: context?.taskId,
+                auditSummary,
             };
             pending.timeout = setTimeout(() => {
                 this.failPendingPermission(sessionId, requestId, 'expired');
@@ -1136,6 +1149,7 @@ export class PermissionGateway {
                 agentName: pending.agentName,
                 role: pending.role,
                 taskId: pending.taskId,
+                summary: pending.auditSummary,
             });
         }
         this.eventBus?.publish({ type: 'permission:resolved', sessionId, requestId, toolName: pending.toolName, approved: normalizedDecision !== 'deny', ...(policyCode ? { decisionSource, policyCode } : { decisionSource }), causation: decisionCausation });
@@ -1213,6 +1227,7 @@ export class PermissionGateway {
                     agentName: pending.agentName,
                     role: pending.role,
                     taskId: pending.taskId,
+                    summary: pending.auditSummary,
                 });
                 this.pending.delete(requestId);
                 const decisionCausation = deriveCausation(pending.causation);

package/dist/core/permission/ec-command-parser.js

@@ -1,15 +1,19 @@
+import { isTrustedWindowsShellExecutable } from '../../utils/windows-shell-trust.js';
 const HEAD_EXECUTABLES = new Set(['head', '/bin/head', '/usr/bin/head']);
 // Codex app-server sends command executions through a fixed shell carrier.
 // Treat the carrier as syntax only after parsing it as literal argv; never
 // accept an arbitrary shell command string or unwrap composition here.
 const CODEX_POSIX_SHELL_EXECUTABLES = new Set([
-    'bash', '/bin/bash', '/usr/bin/bash',
-    'sh', '/bin/sh', '/usr/bin/sh',
+    'bash', 'bash.exe', '/bin/bash', '/usr/bin/bash',
+    'sh', 'sh.exe', '/bin/sh', '/usr/bin/sh',
 ]);
 const CODEX_POWERSHELL_EXECUTABLES = new Set([
     'pwsh', 'pwsh.exe', 'powershell', 'powershell.exe',
 ]);
 const CODEX_POWERSHELL_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Program Files[\\/]PowerShell[\\/][0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9.-]+)?[\\/]pwsh\.exe|Windows[\\/]System32[\\/]WindowsPowerShell[\\/]v1\.0[\\/]powershell\.exe)$/i;
+const CODEX_CUSTOM_POSIX_SHELL_NAMES = new Set(['bash', 'bash.exe', 'sh', 'sh.exe']);
+const CODEX_CUSTOM_POWERSHELL_NAMES = new Set(['pwsh.exe', 'powershell.exe']);
+const CODEX_CUSTOM_CMD_NAMES = new Set(['cmd.exe']);
 const CODEX_CMD_EXECUTABLES = new Set(['cmd', 'cmd.exe']);
 const CODEX_CMD_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Windows[\\/](?:System32|SysWOW64|Sysnative)[\\/]cmd\.exe)$/i;
 // These switches affect only cmd startup/output formatting. `/c` is handled
@@ -17,6 +21,12 @@ const CODEX_CMD_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Windows[\\/](?:System32|Sys
 // `/e:*`, and `/f:*` can change process lifetime or command semantics and are
 // intentionally not treated as a trusted Codex carrier.
 const CODEX_CMD_INERT_SWITCHES = new Set(['/d', '/s', '/q', '/a', '/u']);
+const EVOLCORE_EXECUTABLE_ALIASES = new Set(['ec', 'ec.cmd', 'ec.exe']);
+const EVOLCORE_NODE_EXECUTABLES = new Set(['node', 'node.exe']);
+// Development/install entrypoints that are part of this repository's CLI.
+// Only these exact relative paths are canonicalized; arbitrary Node scripts
+// must never become an EC command merely because their filename is similar.
+const EVOLCORE_NODE_WRAPPER_PATHS = new Set(['bin/ec.js', 'dist/cli/index.js']);
 const SHELL_UNQUOTED_META = new Set([
     ';', '&', '|', '`', '<', '>', '$', '(', ')', '*', '?', '[', ']', '{', '}', '#',
 ]);
@@ -68,8 +78,7 @@ function hasEcCommandPrefix(command) {
         }
         if (boundary && /\s/.test(char))
             continue;
-        if (boundary && command.slice(index, index + 2).toLowerCase() === 'ec'
-            && (index + 2 === command.length || /\s|[;&|`()<>]/.test(command[index + 2])))
+        if (boundary && /^ec(?:\.cmd|\.exe)?(?=$|\s|[;&|`()<>])/i.test(command.slice(index)))
             return true;
         boundary = false;
     }
@@ -78,6 +87,45 @@ function hasEcCommandPrefix(command) {
 function trimShellSpacing(value) {
     return value.replace(/^[ \t]+|[ \t]+$/g, '');
 }
+/**
+ * Accept an explicitly materialized absolute shell path, including Windows
+ * Store/App Execution Alias paths such as `...\\WindowsApps\\pwsh.exe`.
+ * Relative names remain restricted to the fixed executable allowlists above.
+ */
+function isAbsoluteCustomShellPath(value, executableNames) {
+    if (!value || /[\0\r\n"'<>|?*]/.test(value))
+        return false;
+    const normalized = value.replaceAll('\\', '/');
+    if (!/^[A-Za-z]:\//.test(normalized) && !normalized.startsWith('//'))
+        return false;
+    const basename = normalized.slice(normalized.lastIndexOf('/') + 1).toLowerCase();
+    return executableNames.has(basename);
+}
+function isNodeExecutable(value) {
+    if (!value)
+        return false;
+    const normalized = value.toLowerCase();
+    return EVOLCORE_NODE_EXECUTABLES.has(normalized)
+        || isAbsoluteCustomShellPath(value, EVOLCORE_NODE_EXECUTABLES);
+}
+function normalizeNodeWrapperPath(value) {
+    const normalized = value.replaceAll('\\', '/').replace(/^\.\//, '').toLowerCase();
+    return EVOLCORE_NODE_WRAPPER_PATHS.has(normalized) ? normalized : undefined;
+}
+function isCodexPosixShellExecutable(value) {
+    if (!value)
+        return false;
+    return CODEX_POSIX_SHELL_EXECUTABLES.has(value.toLowerCase())
+        || isAbsoluteCustomShellPath(value, CODEX_CUSTOM_POSIX_SHELL_NAMES);
+}
+function isCodexPowerShellExecutable(value) {
+    if (!value)
+        return false;
+    const normalized = value.toLowerCase();
+    return CODEX_POWERSHELL_EXECUTABLES.has(normalized)
+        || CODEX_POWERSHELL_INSTALL_PATH_RE.test(value)
+        || isAbsoluteCustomShellPath(value, CODEX_CUSTOM_POWERSHELL_NAMES);
+}
 const MANAGED_TMPDIR_TOKEN = '__EC_MANAGED_TMPDIR__';
 /**
  * Preserve the one environment reference allowed in managed EC paths.
@@ -154,7 +202,155 @@ function hasCarrierEcCommandPrefix(command, dialect) {
     const inner = input.length >= 2 && input.startsWith('"') && input.endsWith('"')
         ? input.slice(1, -1)
         : input;
-    return /^\s*ec(?:\s|$)/i.test(inner);
+    return /^\s*ec(?:\.cmd|\.exe)?(?:\s|$)/i.test(inner);
+}
+/** Normalize the Windows npm shims to the canonical EvolCore CLI name. */
+export function normalizeEvolcoreCommandArgv(argv) {
+    if (argv.length === 0)
+        return [];
+    const executable = argv[0];
+    if (typeof executable === 'string' && EVOLCORE_EXECUTABLE_ALIASES.has(executable.toLowerCase())) {
+        return ['ec', ...argv.slice(1)];
+    }
+    if (typeof executable === 'string' && isNodeExecutable(executable) && argv.length >= 2
+        && typeof argv[1] === 'string' && normalizeNodeWrapperPath(argv[1])) {
+        return ['ec', ...argv.slice(2)];
+    }
+    return [...argv];
+}
+/** Detect the historical PowerShell pattern that overwrote the thread carrier. */
+export function hasPowerShellDelegationAssignment(command) {
+    return /^\s*\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(command)
+        && /\bec(?:\.cmd|\.exe)?(?:\s|$)/i.test(command);
+}
+/**
+ * Windows Codex may materialize one environment variable assignment directly
+ * in the PowerShell command body instead of inheriting it from the process
+ * environment. Only the EvolCore delegation variable is accepted, and only
+ * when followed by one command on the same carrier. The value is validated for
+ * shape but never trusted for authorization; the runner still arms the stable
+ * in-memory thread carrier.
+ */
+function unwrapPowerShellDelegationPrefix(command) {
+    const input = command.trim();
+    if (!/^\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(input)) {
+        return { kind: 'none', command };
+    }
+    let index = 0;
+    const skipSpace = () => {
+        while (index < input.length && (input[index] === ' ' || input[index] === '\t'))
+            index++;
+    };
+    const consume = (value) => {
+        if (input.slice(index, index + value.length).toLowerCase() !== value.toLowerCase())
+            return false;
+        index += value.length;
+        return true;
+    };
+    skipSpace();
+    if (!consume('$env') || input[index] !== ':')
+        return { kind: 'invalid', command };
+    index++;
+    skipSpace();
+    if (!consume('EVOLCORE_DELEGATION_TOKEN'))
+        return { kind: 'invalid', command };
+    skipSpace();
+    if (input[index] !== '=')
+        return { kind: 'invalid', command };
+    index++;
+    skipSpace();
+    const quote = input[index];
+    if (quote !== "'" && quote !== '"')
+        return { kind: 'invalid', command };
+    const valueStart = index++;
+    let value = '';
+    let closed = false;
+    // When the complete -Command body is itself single-quoted, command-line
+    // serialization can leave the assignment value in a doubled `''token''`
+    // form. Its token alphabet cannot contain quotes, so this exact shape is
+    // unambiguous and can be decoded without executing PowerShell grammar.
+    if (quote === "'" && input[valueStart + 1] === "'") {
+        const contentStart = valueStart + 2;
+        const end = input.indexOf("''", contentStart);
+        if (end < contentStart)
+            return { kind: 'invalid', command };
+        value = input.slice(contentStart, end);
+        index = end + 2;
+        closed = true;
+    }
+    while (index < input.length) {
+        if (closed)
+            break;
+        const char = input[index];
+        if (char === quote) {
+            // PowerShell single-quoted strings escape a quote as `''`. For the
+            // delegation token alphabet this is not needed, but accepting it lets us
+            // decode the doubled-quote form emitted by powershell.exe argv quoting.
+            if (quote === "'" && input[index + 1] === "'") {
+                value += "'";
+                index += 2;
+                continue;
+            }
+            index++;
+            closed = true;
+            break;
+        }
+        if (quote === '"' && char === '`')
+            return { kind: 'invalid', command };
+        if (char === '\r' || char === '\n')
+            return { kind: 'invalid', command };
+        value += char;
+        index++;
+    }
+    if (!closed || index <= valueStart + 1 || !/^[A-Za-z0-9_-]{32,128}$/.test(value)) {
+        return { kind: 'invalid', command };
+    }
+    if (input[index] !== ';')
+        return { kind: 'invalid', command };
+    index++;
+    const remainder = input.slice(index).trim();
+    if (!remainder)
+        return { kind: 'invalid', command };
+    return { kind: 'valid', command: remainder, token: value };
+}
+export function parseCodexCarrierCommand(carrier, options = {}) {
+    if (options.verifyShellExecutable) {
+        if (!carrier.executable) {
+            return parseFailure('untrusted-shell', carrier.command, 0, 0, carrier.dialect);
+        }
+        const kind = carrier.dialect === 'posix' ? 'bash' : carrier.dialect;
+        if (!isTrustedWindowsShellExecutable(carrier.executable, kind)) {
+            return parseFailure('untrusted-shell', carrier.command, 0, 0, carrier.dialect);
+        }
+    }
+    const unwrapped = carrier.dialect === 'powershell'
+        ? unwrapPowerShellDelegationPrefix(carrier.command)
+        : { kind: 'none', command: carrier.command };
+    // Windows PowerShell may materialize the thread's shell environment as a
+    // single `$env:EVOLCORE_DELEGATION_TOKEN = '...'` prefix. Keep the token as
+    // metadata for the approval layer, which must compare it with the runner's
+    // in-memory carrier before arming delegation. Malformed or unrelated
+    // assignments remain syntax failures and can never be authorized.
+    if (unwrapped.kind === 'invalid'
+        || (carrier.dialect === 'powershell'
+            && hasPowerShellDelegationAssignment(carrier.command)
+            && unwrapped.kind === 'none')
+        || (unwrapped.kind === 'valid'
+            && options.expectedDelegationToken !== undefined
+            && options.expectedDelegationToken !== unwrapped.token)) {
+        return parseFailure('shell-composition', carrier.command, 0, 0, carrier.dialect);
+    }
+    const parsed = parseLiteralShellCommand(unwrapped.command, {
+        ...options,
+        dialect: carrier.dialect,
+    });
+    return parsed.ok
+        ? {
+            ...parsed,
+            argv: normalizeEvolcoreCommandArgv(parsed.argv),
+            ...(unwrapped.kind === 'valid' ? { delegationToken: unwrapped.token } : {}),
+        }
+        : parsed;
 }
 function parseFailure(issue, input, offset, tokenIndex, dialect) {
     return {
@@ -355,7 +551,9 @@ function isCodexCmdExecutable(value) {
     if (!value)
         return false;
     const normalized = value.toLowerCase();
-    return CODEX_CMD_EXECUTABLES.has(normalized) || CODEX_CMD_INSTALL_PATH_RE.test(value);
+    return CODEX_CMD_EXECUTABLES.has(normalized)
+        || CODEX_CMD_INSTALL_PATH_RE.test(value)
+        || isAbsoluteCustomShellPath(value, CODEX_CUSTOM_CMD_NAMES);
 }
 function resolveCodexCmdCarrierArgv(argv) {
     if (argv.length < 3 || !isCodexCmdExecutable(argv[0]))
@@ -377,7 +575,7 @@ function resolveCodexCmdCarrierArgv(argv) {
     }
     const command = argv.at(-1);
     return typeof command === 'string' && command.trim()
-        ? { command, dialect: 'cmd' }
+        ? { command, dialect: 'cmd', executable: argv[0] }
         : undefined;
 }
 /** Resolve a Windows cmd carrier when the app-server provides only a string. */
@@ -402,10 +600,7 @@ function resolveCodexPowerShellCarrierString(command) {
     if (!match)
         return undefined;
     const executable = match[1] ?? match[2];
-    const normalized = executable.toLowerCase();
-    const isPowerShell = CODEX_POWERSHELL_EXECUTABLES.has(normalized)
-        || CODEX_POWERSHELL_INSTALL_PATH_RE.test(executable);
-    if (!isPowerShell)
+    if (!isCodexPowerShellExecutable(executable))
         return undefined;
     // A string-form carrier has one additional command-line quoting layer. The
     // command argument is commonly serialized as `"ec ..."`; remove exactly
@@ -416,11 +611,31 @@ function resolveCodexPowerShellCarrierString(command) {
             || (nested.startsWith("'") && nested.endsWith("'")))) {
         nested = nested.slice(1, -1);
     }
-    return nested ? { command: nested, dialect: 'powershell' } : undefined;
+    return nested ? { command: nested, dialect: 'powershell', executable } : undefined;
+}
+/** Resolve a POSIX shell carrier when app-server provides only a string. */
+function resolveCodexPosixShellCarrierString(command) {
+    const input = trimShellSpacing(command);
+    const match = input.match(/^(?:"([^"]+)"|(\S+))\s+(-lc|-c)\s+(.+)$/);
+    if (!match)
+        return undefined;
+    const executable = match[1] ?? match[2];
+    if (!isCodexPosixShellExecutable(executable))
+        return undefined;
+    // A string-form carrier has one additional command-line quoting layer. Strip
+    // only the outer pair; quotes belonging to the nested command remain intact.
+    let nested = match[4].trim();
+    if (nested.length >= 2
+        && ((nested.startsWith('"') && nested.endsWith('"'))
+            || (nested.startsWith("'") && nested.endsWith("'")))) {
+        nested = nested.slice(1, -1);
+    }
+    return nested ? { command: nested, dialect: 'posix', executable } : undefined;
 }
 export function resolveCodexShellCarrierString(command) {
     return resolveCodexCmdCarrierString(command)
-        ?? resolveCodexPowerShellCarrierString(command);
+        ?? resolveCodexPowerShellCarrierString(command)
+        ?? resolveCodexPosixShellCarrierString(command);
 }
 /**
  * Extract a trusted cmd executable's command body without trusting its startup
@@ -462,7 +677,7 @@ function looksLikeEcCommandBody(command) {
         return false;
     const input = command.trim();
     const body = (input.startsWith('"') ? input.slice(1) : input).trimStart();
-    return /^ec(?:\s|$)/i.test(body);
+    return /^ec(?:\.cmd|\.exe)?(?:\s|$)/i.test(body);
 }
 /** True only when a trusted cmd executable is carrying an EC command body. */
 export function hasCodexCmdCarrierEcIntent(input) {
@@ -627,15 +842,14 @@ export function parseLiteralShellArgv(command, options = {}) {
     return result.ok ? result.argv : null;
 }
 export function resolveCodexShellCarrierArgv(argv) {
-    if (argv.length === 3 && argv[1] === '-lc' && CODEX_POSIX_SHELL_EXECUTABLES.has(argv[0])) {
-        return { command: argv[2], dialect: 'posix' };
+    if (argv.length === 3
+        && (argv[1] === '-lc' || argv[1] === '-c')
+        && isCodexPosixShellExecutable(argv[0])) {
+        return { command: argv[2], dialect: 'posix', executable: argv[0] };
     }
     if (argv.length === 3) {
-        const powershellExecutable = argv[0].toLowerCase();
-        const isPowerShell = CODEX_POWERSHELL_EXECUTABLES.has(powershellExecutable)
-            || CODEX_POWERSHELL_INSTALL_PATH_RE.test(argv[0]);
-        if (isPowerShell && argv[1].toLowerCase() === '-command') {
-            return { command: argv[2], dialect: 'powershell' };
+        if (isCodexPowerShellExecutable(argv[0]) && argv[1].toLowerCase() === '-command') {
+            return { command: argv[2], dialect: 'powershell', executable: argv[0] };
         }
     }
     // Node/cross-spawn and Codex use cmd.exe with a small set of startup flags.
@@ -656,27 +870,26 @@ export function parseCodexShellCommandArgv(command, options = {}) {
     if (outer) {
         const carrier = resolveCodexShellCarrierArgv(outer);
         if (carrier !== undefined) {
-            return parseLiteralShellArgv(carrier.command, { ...options, dialect: carrier.dialect });
+            const parsed = parseCodexCarrierCommand(carrier, options);
+            return parsed.ok ? parsed.argv : null;
         }
         const stringCarrier = resolveCodexShellCarrierString(command);
         if (stringCarrier) {
-            return parseLiteralShellArgv(stringCarrier.command, { ...options, dialect: stringCarrier.dialect });
+            const parsed = parseCodexCarrierCommand(stringCarrier, options);
+            return parsed.ok ? parsed.argv : null;
         }
         if (parseCodexCmdCarrierStringFailure(command, options))
             return null;
-        return outer;
+        return normalizeEvolcoreCommandArgv(outer);
     }
     const stringCarrier = resolveCodexShellCarrierString(command);
     if (!stringCarrier)
         return null;
-    const parsed = parseLiteralShellCommand(stringCarrier.command, {
-        ...options,
-        dialect: stringCarrier.dialect,
-    });
-    return parsed.ok ? parsed.argv : null;
+    const parsed = parseCodexCarrierCommand(stringCarrier, options);
+    return parsed.ok ? normalizeEvolcoreCommandArgv(parsed.argv) : null;
 }
 /** Parse a Codex tool input while preserving safe syntax failure metadata. */
-export function parseCodexToolCommand(input) {
+export function parseCodexToolCommand(input, options = {}) {
     if (Array.isArray(input.commandArgv)) {
         if (!input.commandArgv.every(value => typeof value === 'string')) {
             return parseFailure('invalid-control-char', '', 0, 0, 'posix');
@@ -687,46 +900,36 @@ export function parseCodexToolCommand(input) {
             return parseFailure('invalid-control-char', '', 0, nulIndex, 'posix');
         const carrier = resolveCodexShellCarrierArgv(outer);
         if (carrier === undefined) {
-            return parseCodexCmdCarrierArgvFailure(outer) ?? { ok: true, argv: outer };
+            return parseCodexCmdCarrierArgvFailure(outer)
+                ?? { ok: true, argv: normalizeEvolcoreCommandArgv(outer) };
         }
-        return parseLiteralShellCommand(carrier.command, {
-            allowManagedTmpDir: true,
-            dialect: carrier.dialect,
-        });
+        return parseCodexCarrierCommand(carrier, { allowManagedTmpDir: true, ...options });
     }
     const command = typeof input.command === 'string' ? input.command : '';
     const outer = parseLiteralShellCommand(command, { allowManagedTmpDir: true });
     if (outer.ok) {
         const carrier = resolveCodexShellCarrierArgv(outer.argv);
         if (carrier !== undefined) {
-            return parseLiteralShellCommand(carrier.command, {
-                allowManagedTmpDir: true,
-                dialect: carrier.dialect,
-            });
+            return parseCodexCarrierCommand(carrier, { allowManagedTmpDir: true, ...options });
         }
         const stringCarrier = resolveCodexShellCarrierString(command);
         return stringCarrier
-            ? parseLiteralShellCommand(stringCarrier.command, {
-                allowManagedTmpDir: true,
-                dialect: stringCarrier.dialect,
-            })
-            : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true }) ?? outer;
+            ? parseCodexCarrierCommand(stringCarrier, { allowManagedTmpDir: true, ...options })
+            : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true })
+                ?? { ...outer, argv: normalizeEvolcoreCommandArgv(outer.argv) };
     }
     const stringCarrier = resolveCodexShellCarrierString(command);
     return stringCarrier
-        ? parseLiteralShellCommand(stringCarrier.command, {
-            allowManagedTmpDir: true,
-            dialect: stringCarrier.dialect,
-        })
+        ? parseCodexCarrierCommand(stringCarrier, { allowManagedTmpDir: true, ...options })
         : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true }) ?? outer;
 }
 /**
  * Resolve a Codex command input while preserving the raw `commandArgv` form
  * supplied by app-server. Joining that argv with spaces loses the quoting of
- * the inner `-lc` command and was the source of a false proactive denial.
+ * the inner `-c`/`-lc` command and was the source of a false proactive denial.
  */
-export function parseCodexToolCommandArgv(input) {
-    const result = parseCodexToolCommand(input);
+export function parseCodexToolCommandArgv(input, options = {}) {
+    const result = parseCodexToolCommand(input, options);
     return result.ok ? result.argv : null;
 }
 function isSimpleExecStringLiteral(value) {
@@ -1214,12 +1417,15 @@ export function parseCodexExecToolCommand(input) {
     return decoded;
 }
 function parseProactiveToolCommandArgv(toolName, input) {
+    const options = {
+        verifyShellExecutable: process.platform === 'win32',
+    };
     if (toolName === 'Bash' || toolName === 'Shell')
-        return parseCodexToolCommandArgv(input);
+        return parseCodexToolCommandArgv(input, options);
     if (toolName !== 'exec')
         return null;
     const command = parseCodexExecToolCommand(input);
-    return command ? parseCodexShellCommandArgv(command, { allowManagedTmpDir: true }) : null;
+    return command ? parseCodexShellCommandArgv(command, { allowManagedTmpDir: true, ...options }) : null;
 }
 function scanBoundedOutputOperators(command) {
     const operators = [];
@@ -1410,29 +1616,25 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
     const parseOptions = { allowManagedTmpDir: true, ...options };
     const literal = parseLiteralShellCommand(command, parseOptions);
     if (literal.ok) {
-        if (literal.argv[0] === 'ec')
+        if (normalizeEvolcoreCommandArgv(literal.argv)[0] === 'ec')
             return { kind: 'literal' };
         const carrier = resolveCodexShellCarrierArgv(literal.argv);
         if (carrier !== undefined) {
-            const nested = parseLiteralShellCommand(carrier.command, {
-                ...parseOptions,
-                dialect: carrier.dialect,
-            });
+            const nested = parseCodexCarrierCommand(carrier, parseOptions);
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
-            if (!nested.ok && hasCarrierEcCommandPrefix(carrier.command, carrier.dialect)) {
+            if (!nested.ok && (hasCarrierEcCommandPrefix(carrier.command, carrier.dialect)
+                || (carrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(carrier.command)))) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
         const stringCarrier = resolveCodexShellCarrierString(command);
         if (stringCarrier) {
-            const nested = parseLiteralShellCommand(stringCarrier.command, {
-                ...parseOptions,
-                dialect: stringCarrier.dialect,
-            });
+            const nested = parseCodexCarrierCommand(stringCarrier, parseOptions);
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
-            if (!nested.ok && hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)) {
+            if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
+                || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
@@ -1450,13 +1652,11 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
     }
     const stringCarrier = resolveCodexShellCarrierString(command);
     if (stringCarrier) {
-        const nested = parseLiteralShellCommand(stringCarrier.command, {
-            ...parseOptions,
-            dialect: stringCarrier.dialect,
-        });
+        const nested = parseCodexCarrierCommand(stringCarrier, parseOptions);
         if (nested.ok && nested.argv[0] === 'ec')
             return { kind: 'literal' };
-        if (!nested.ok && hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)) {
+        if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
+            || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
             return { kind: 'composite', issue: nested.issue };
         }
         return { kind: 'none' };
@@ -1687,7 +1887,9 @@ export function parseEvolcoreSendCommand(command) {
 export function isEvolcoreSendCommandForSession(toolName, input, channelId) {
     if (toolName !== 'Bash')
         return false;
-    const argv = parseCodexToolCommandArgv(input);
+    const argv = parseCodexToolCommandArgv(input, {
+        verifyShellExecutable: process.platform === 'win32',
+    });
     const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
     if (!parsed)
         return false;