evolcore 0.0.21 → 0.0.23

package/dist/core/permission/protected-paths.js

@@ -268,21 +268,21 @@ export function getHClassSandboxPatterns(root = resolveRoot()) {
         '.lock',
         'daemon.pid',
         path.join('data', 'causation-aun.json*'),
-        path.join('data', 'triggers', '**'),
-        path.join('data', 'sessions', '**'),
+        path.join('data', 'triggers') + '/**',
+        path.join('data', 'sessions') + '/**',
         path.join('data', 'contact-book-audit.jsonl'),
         path.join('data', 'feishu-seen-*.jsonl'),
         path.join('data', '*-greeted-*.jsonl'),
         path.join('data', 'message-queue.json*'),
         path.join('data', 'daemon', 'message-queue.json*'),
-        path.join('data', 'daemon', 'control', '**'),
-        path.join('data', 'daemon', 'migrations', '**'),
-        path.join('data', 'channel-state', '**'),
+        path.join('data', 'daemon', 'control') + '/**',
+        path.join('data', 'daemon', 'migrations') + '/**',
+        path.join('data', 'channel-state') + '/**',
         path.join('data', 'instance', 'control.token'),
         path.join('data', 'outbox'),
-        path.join('data', 'outbox', '**'),
+        path.join('data', 'outbox') + '/**',
         path.join('data', 'handoff'),
-        path.join('data', 'handoff', '**'),
+        path.join('data', 'handoff') + '/**',
         path.join('agents', '*', 'sessions', '**'),
         path.join('agents', '*', 'data', 'channels', '**'),
         path.join('agents', '*', 'data', 'handoff', '**'),
@@ -296,12 +296,13 @@ export function getLClassWritePatterns(root = resolveRoot()) {
     const absoluteRoot = resolveThroughExistingAncestor(root);
     return [
         path.join(absoluteRoot, 'agents', '*', 'triggers'),
-        path.join(absoluteRoot, 'agents', '*', 'triggers', '**'),
-        path.join(absoluteRoot, 'agents', '*', 'roles', '**'),
+        path.join(absoluteRoot, 'agents', '*', 'triggers') + '/**',
+        path.join(absoluteRoot, 'agents', '*', 'roles') + '/**',
     ];
 }
 const CLAUDE_PROTECTED_TARGET_LIMIT = 8192;
 const CLAUDE_GLOB_MAGIC = /[*?[\]]/;
+const CODEX_GLOB_MAGIC = /[*?[\]]/;
 function addExistingTarget(targets, value) {
     try {
         const stat = fs.lstatSync(value);
@@ -427,12 +428,70 @@ export function buildClaudeProtectedFilesystem(root = resolveRoot(), options = {
     };
 }
 export function buildCodexHClassFilesystemRules(root = resolveRoot()) {
-    return {
+    const filesystem = {
         // Codex pre-expands unbounded deny globs on Linux/WSL/Windows. Without a
         // bound, patterns such as **/*.json_ are accepted but may not be enforced.
         glob_scan_max_depth: 64,
-        ...Object.fromEntries(getHClassSandboxPatterns(root).map(pattern => [pattern, 'deny'])),
+        ...Object.fromEntries(filterWindowsCodexFilesystemTargets(getHClassSandboxPatterns(root)).map(pattern => [pattern, 'deny'])),
     };
+    return compactWindowsCodexFilesystemRules(filesystem);
+}
+/**
+ * Windows Codex sandbox setup materializes a path while applying its deny-read
+ * ACL.  A nonexistent exact file target can therefore become a directory on
+ * disk (for example `daemon.pid`).  Keep existing paths and globs, but omit
+ * nonexistent exact paths so the sandbox never creates the wrong filesystem
+ * object.  Non-Windows callers retain the historical rule set.
+ */
+export function filterWindowsCodexFilesystemTargets(patterns, platform = process.platform) {
+    if (platform !== 'win32')
+        return patterns;
+    return patterns.filter(pattern => {
+        if (CODEX_GLOB_MAGIC.test(pattern))
+            return true;
+        try {
+            fs.lstatSync(pattern);
+            return true;
+        }
+        catch (error) {
+            const code = error && typeof error === 'object' && 'code' in error
+                ? error.code
+                : undefined;
+            return code === 'ENOENT' ? false : true;
+        }
+    });
+}
+/**
+ * Codex expands recursive deny globs into individual targets. Large protected
+ * trees on Windows can then fail during AGENTS.md loading with os error 206.
+ * Directory denies inherit to descendants through the Windows sandbox ACLs,
+ * avoiding redundant targets. Keep broad recursive filename globs intact.
+ */
+export function compactWindowsCodexFilesystemRules(filesystem, platform = process.platform) {
+    if (platform !== 'win32')
+        return filesystem;
+    const compacted = {};
+    for (const [pattern, access] of Object.entries(filesystem)) {
+        const isTerminalRecursiveDeny = access === 'deny'
+            && (pattern.endsWith('/**') || pattern.endsWith('\\**'));
+        const recursiveRoot = isTerminalRecursiveDeny ? pattern.slice(0, -3) : undefined;
+        // Only collapse a recursive deny when its root is a real directory.  A
+        // missing root must remain a glob: turning it into an exact target can
+        // make the Windows sandbox materialize that path as a directory.
+        const canCompact = !!recursiveRoot
+            && (CODEX_GLOB_MAGIC.test(recursiveRoot) || (() => {
+                try {
+                    return fs.lstatSync(recursiveRoot).isDirectory();
+                }
+                catch {
+                    return false;
+                }
+            })());
+        const compactPattern = canCompact ? recursiveRoot : pattern;
+        if (compacted[compactPattern] !== 'deny')
+            compacted[compactPattern] = access;
+    }
+    return compacted;
 }
 export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options = {}) {
     const lClassRules = {};
@@ -451,17 +510,18 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
                 lClassRules[target.path] = lClassAccess;
             }
             if (expandLClassReadDeny || !options.denyLClassRead) {
-                lClassRules[path.join(target.path, '**')] = lClassAccess;
+                // Use '/**' suffix instead of path.join to satisfy Codex's glob requirement
+                lClassRules[target.path + '/**'] = lClassAccess;
             }
         }
         else {
             lClassRules[target.path] = lClassAccess;
         }
     }
-    return {
+    return compactWindowsCodexFilesystemRules({
         ...buildCodexHClassFilesystemRules(root),
         ...lClassRules,
-    };
+    });
 }
 export function hClassGrantIncludesProtectedPath(value, options = {}) {
     const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());

package/dist/core/permission/sandbox-runtime.js

@@ -497,8 +497,10 @@ export function buildHClassGuardCommand(executable, executableArgs, root = resol
         '--dev-bind', '/dev', '/dev',
         '--proc', '/proc',
     ];
-    appendLClassReadOnlyBinds(args, path.resolve(root));
-    appendHClassMasks(args, path.resolve(root), true);
+    if (options.protectEvolcoreFilesystem !== false) {
+        appendLClassReadOnlyBinds(args, path.resolve(root));
+        appendHClassMasks(args, path.resolve(root), true);
+    }
     if (options.managedCodexRequirements) {
         const requirements = path.resolve(options.managedCodexRequirements);
         if (!fs.statSync(requirements).isFile()) {

package/dist/core/permission/tool-error-code.js

@@ -14,6 +14,18 @@ export function classifyToolErrorCode(input) {
     const explicit = normalizeToolErrorCode(input.errorCode);
     if (explicit)
         return explicit;
+    if (input.decisionSource === 'policy')
+        return 'POLICY_DENIED';
+    if (input.decisionSource === 'approval')
+        return 'USER_DENIED';
+    return 'EXECUTION_FAILED';
+}
+/**
+ * Compatibility classifier for historical, unstructured logs only.
+ * Production event producers must use classifyToolErrorCode() and explicit
+ * errorCode/decisionSource fields instead of interpreting command output.
+ */
+export function classifyLegacyToolErrorText(input) {
     const text = [input.error, input.result]
         .map(value => {
         if (typeof value === 'string')

package/dist/core/permission/tool-policy.js

@@ -4,7 +4,7 @@ import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
 import { containsHClassReference, containsLClassReference, checkProtectedPathAccess, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, resolveProtectedCandidateWithoutFinalSymlink, } from './protected-paths.js';
-import { classifyEvolcoreShellCommand, hasCodexCmdCarrierEcIntent, parseCodexToolCommandArgv, parseBoundedOutputShellCommand, parseLiteralShellArgv, resolveCodexShellCarrierArgv, resolveCodexShellCarrierString, } from './ec-command-parser.js';
+import { classifyEvolcoreShellCommand, hasCodexCmdCarrierEcIntent, hasPowerShellDelegationAssignment, parseCodexToolCommand, parseBoundedOutputShellCommand, parseLiteralShellArgv, resolveCodexShellCarrierArgv, resolveCodexShellCarrierString, } from './ec-command-parser.js';
 import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
 /** Resolve the session-owned temporary root supplied by the execution host. */
 export function resolveManagedTempDir(env = process.env) {
@@ -91,15 +91,179 @@ export function maskManagedTempShellPaths(command, options = {}) {
         return `__managed_tmp_${index}__`;
     });
 }
-// 绝对禁止命令（所有角色、所有权限模式下都禁止，不可授权）
-// 这些是系统级破坏操作，任何情况下都不应该允许
 const ABSOLUTE_FORBIDDEN = [
-    /\bshutdown\b/, // 关机
-    /\breboot\b/, // 重启
-    /\bmkfs\b/, // mkfs (格式化文件系统)
-    /\bformat\s+[a-zA-Z]:/i, // format C: (格式化磁盘)
-    /\bdd\s+if=.*of=\/dev/, // dd 写入磁盘设备（读取操作允许）
+    /\bshutdown\b/i,
+    /\breboot\b/i,
+    /\bmkfs(?:\.[A-Za-z0-9._-]+)?\b/i,
+    /\bformat\s+[a-zA-Z]:/i,
+    /\bdd\s+if=.*of=\/dev(?:\/|\b)/i,
 ];
+const SCRIPT_EXECUTION_RE = /(?:\bos\.system\s*\(|\bsubprocess\.(?:run|call|Popen)\s*\(|\bchild_process\.(?:exec|spawn|fork)\s*\(|\b(?:system|exec|spawn|popen)\s*\()/i;
+function hereDocDelimiter(line) {
+    let quote;
+    let escaped = false;
+    for (let index = 0; index < line.length - 1; index++) {
+        const char = line[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\' && quote !== 'single') {
+            escaped = true;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = undefined;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '"')
+                quote = undefined;
+            continue;
+        }
+        if (char === "'") {
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            continue;
+        }
+        if (char !== '<' || line[index + 1] !== '<' || line[index + 2] === '<')
+            continue;
+        let cursor = index + 2;
+        if (line[cursor] === '-')
+            cursor++;
+        while (cursor < line.length && /\s/.test(line[cursor]))
+            cursor++;
+        if (line[cursor] === "'" || line[cursor] === '"') {
+            const delimiterQuote = line[cursor++];
+            const start = cursor;
+            while (cursor < line.length && line[cursor] !== delimiterQuote)
+                cursor++;
+            return cursor > start && cursor < line.length ? line.slice(start, cursor) : undefined;
+        }
+        const match = line.slice(cursor).match(/^[A-Za-z_][A-Za-z0-9_-]*/);
+        return match?.[0];
+    }
+    return undefined;
+}
+function splitHereDocBodies(command) {
+    const lines = command.split(/\r?\n/);
+    let delimiter;
+    let body;
+    const bodies = [];
+    const retained = [];
+    for (const line of lines) {
+        if (delimiter) {
+            const candidate = line.replace(/^\t+/, '').trim();
+            if (candidate === delimiter) {
+                bodies.push((body ?? []).join('\n'));
+                delimiter = undefined;
+                body = undefined;
+            }
+            else {
+                body?.push(line);
+            }
+            continue;
+        }
+        retained.push(line);
+        delimiter = hereDocDelimiter(line);
+        if (delimiter)
+            body = [];
+    }
+    if (delimiter && body)
+        bodies.push(body.join('\n'));
+    return { command: retained.join('\n'), bodies };
+}
+function containsAbsoluteForbiddenText(value) {
+    return ABSOLUTE_FORBIDDEN.some(pattern => pattern.test(value));
+}
+function interpreterScript(args) {
+    const index = args.findIndex(argument => argument === '-c' || argument === '-e' || argument === '--eval');
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function scriptContainsAbsoluteForbidden(script) {
+    return SCRIPT_EXECUTION_RE.test(script) && containsAbsoluteForbiddenText(script);
+}
+/** Match only executable argv, never regex/search text or script literals. */
+function containsAbsoluteForbiddenCommand(command, depth = 0) {
+    const hereDocs = splitHereDocBodies(command);
+    if (containsShellSubstitution(hereDocs.command) && containsAbsoluteForbiddenText(hereDocs.command))
+        return true;
+    return splitShellCommandSegments(hereDocs.command).some(segment => {
+        const parsed = parseEffectiveCommand(segment);
+        if (!parsed)
+            return false;
+        const { executable, args } = parsed;
+        if (executable === 'shutdown' || executable === 'reboot')
+            return true;
+        if (/^mkfs(?:\..*)?$/.test(executable))
+            return true;
+        if (executable === 'format' && args.some(argument => /^[A-Za-z]:$/.test(argument)))
+            return true;
+        if (executable === 'dd'
+            && args.some(argument => /^if=/.test(argument))
+            && args.some(argument => /^of=\/dev(?:\/|$)/.test(argument)))
+            return true;
+        if (executable === 'eval' && containsAbsoluteForbiddenText(args.join(' ')))
+            return true;
+        if (['node', 'nodejs', 'python', 'python3', 'perl'].includes(executable)) {
+            const script = interpreterScript(args);
+            if (script && scriptContainsAbsoluteForbidden(script))
+                return true;
+            if (hereDocs.bodies.some(scriptContainsAbsoluteForbidden))
+                return true;
+        }
+        if (['bash', 'sh', 'zsh', 'dash'].includes(executable)
+            && hereDocs.bodies.some(body => containsAbsoluteForbiddenCommand(body, depth + 1)))
+            return true;
+        if (depth >= 2 || !['bash', 'sh', 'zsh', 'dash', 'cmd', 'cmd.exe'].includes(executable))
+            return false;
+        const commandFlag = executable.startsWith('cmd') ? '/c' : '-c';
+        const commandIndex = args.findIndex(argument => argument.toLowerCase() === commandFlag);
+        return commandIndex >= 0
+            && !!args[commandIndex + 1]
+            && containsAbsoluteForbiddenCommand(args.slice(commandIndex + 1).join(' '), depth + 1);
+    });
+}
+function containsShellSubstitution(command) {
+    let quote;
+    let escaped = false;
+    for (let index = 0; index < command.length; index++) {
+        const char = command[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\' && quote !== 'single') {
+            escaped = true;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = undefined;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '"')
+                quote = undefined;
+            continue;
+        }
+        if (char === "'") {
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            continue;
+        }
+        if (char === '`' || (char === '$' && command[index + 1] === '('))
+            return true;
+    }
+    return false;
+}
 // 危险操作（需要用户审批才能执行）
 // 这些操作有合理使用场景，但需要用户明确授权
 const DANGEROUS_PATTERNS = [
@@ -386,7 +550,8 @@ function classifyStructuredCommand(command, depth = 0) {
     return matches.find(match => match.approvalScope === 'all') ?? matches[0];
 }
 function containsNetStopCommand(command, depth = 0) {
-    return splitShellCommandSegments(command).some(segment => {
+    const hereDocs = splitHereDocBodies(command);
+    return splitShellCommandSegments(hereDocs.command).some(segment => {
         const parsed = parseEffectiveCommand(segment);
         if (!parsed)
             return false;
@@ -394,6 +559,9 @@ function containsNetStopCommand(command, depth = 0) {
             && parsed.args[0]?.toLowerCase() === 'stop') {
             return true;
         }
+        if (['bash', 'sh', 'zsh', 'dash'].includes(parsed.executable)
+            && hereDocs.bodies.some(body => containsNetStopCommand(body, depth + 1)))
+            return true;
         if (depth >= 2 || !['bash', 'sh', 'zsh', 'dash', 'cmd', 'cmd.exe'].includes(parsed.executable)) {
             return false;
         }
@@ -1192,6 +1360,54 @@ function readonlySourceDiagnosticAllowed(analysis, projectPath) {
             && !isLClassPath(candidate, { root: resolveRoot() });
     });
 }
+/**
+ * A narrow exception for the common repository source inventory query. The
+ * general recursive H-class rule remains fail-closed; only an opt-in,
+ * single-find query whose output is limited to TypeScript/JavaScript files at
+ * the project root can use this path.
+ */
+function boundedRootSourceEnumeration(analysis, projectPath) {
+    if (analysis.kind !== 'proven-readonly' || analysis.ir.pipelines.length !== 1)
+        return false;
+    const pipeline = analysis.ir.pipelines[0];
+    const find = pipeline[0];
+    if (!find || find.executable !== 'find' || find.pathOperands.length !== 1 || find.pathOperands[0].access !== 'recursive') {
+        return false;
+    }
+    const workspace = resolveProtectedCandidate(projectPath);
+    if (workspace === path.parse(workspace).root)
+        return false;
+    const scope = resolveProtectedCandidate(find.pathOperands[0].value, projectPath);
+    if (scope !== workspace)
+        return false;
+    const allowedPredicates = new Set(['-o', '-or', '-a', '-and', '-print', '-print0']);
+    let sawSourceSuffix = false;
+    const scopeIndex = find.argv.indexOf(find.pathOperands[0].value);
+    if (scopeIndex < 1)
+        return false;
+    const args = find.argv.slice(scopeIndex + 1);
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index];
+        if (argument === '-name' || argument === '-iname') {
+            const pattern = args[++index];
+            if (!pattern || !/^\*\.(?:ts|js)$/i.test(pattern))
+                return false;
+            sawSourceSuffix = true;
+            continue;
+        }
+        if (argument === '-type') {
+            if (args[++index] !== 'f')
+                return false;
+            continue;
+        }
+        if (!allowedPredicates.has(argument))
+            return false;
+    }
+    if (!sawSourceSuffix)
+        return false;
+    return pipeline.slice(1).every(command => ['head', 'sort', 'grep', 'wc'].includes(command.executable)
+        && command.pathOperands.length === 0);
+}
 /** A lock filename used as a query pattern is safe; an operand naming the
  * actual lock path is still protected. */
 function containsLockPathReference(value) {
@@ -1246,10 +1462,13 @@ export function checkReadonly(toolName, input, projectPath, context) {
             managedTempDir,
             allowProtectedMetadata: context?.allowProtectedMetadata,
         });
+        const sourceQueryAllowed = readonlySourceDiagnosticAllowed(protectedOperands.analysis, projectPath);
+        const boundedSourceQueryAllowed = boundedRootSourceEnumeration(protectedOperands.analysis, projectPath);
         const sourceDiagnosticAllowed = context?.allowReadonlySourceDiagnostics
-            && readonlySourceDiagnosticAllowed(protectedOperands.analysis, projectPath)
-            && !protectedOperands.lClass
-            && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass));
+            && (!protectedOperands.lClass || boundedSourceQueryAllowed)
+            && ((sourceQueryAllowed
+                && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass)))
+                || boundedSourceQueryAllowed);
         if (sourceDiagnosticAllowed) {
             return { behavior: 'allow' };
         }
@@ -1556,11 +1775,15 @@ export function checkHClassWrite(toolName, input, context) {
             managedTempDir: context?.managedTempDir,
             allowProtectedMetadata: context?.allowProtectedMetadata,
         });
+        const sourceDiagnosticProjectPath = context?.projectPath ?? process.cwd();
+        const sourceQueryAllowed = readonlySourceDiagnosticAllowed(protectedOperands.analysis, sourceDiagnosticProjectPath);
+        const boundedSourceQueryAllowed = boundedRootSourceEnumeration(protectedOperands.analysis, sourceDiagnosticProjectPath);
         const sourceDiagnosticAllowed = context?.permissionMode === 'readonly'
             && context.allowReadonlySourceDiagnostics === true
-            && readonlySourceDiagnosticAllowed(protectedOperands.analysis, context.projectPath ?? process.cwd())
-            && !protectedOperands.lClass
-            && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass));
+            && (!protectedOperands.lClass || boundedSourceQueryAllowed)
+            && ((sourceQueryAllowed
+                && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass)))
+                || boundedSourceQueryAllowed);
         if (protectedOperands.hClass && !sourceDiagnosticAllowed) {
             logger.warn(`[H-Class Protection] 🔒 Protected filesystem operand in shell command: tool=${toolName} ` +
                 `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
@@ -1721,7 +1944,10 @@ export function checkLClassWrite(toolName, input, context) {
             ...pathOptions,
             managedTempDir: context?.managedTempDir,
         });
+        const boundedSourceQueryAllowed = context?.allowReadonlySourceDiagnostics === true
+            && boundedRootSourceEnumeration(protectedOperands.analysis, context?.projectPath ?? process.cwd());
         const lClassDenied = protectedOperands.lClass
+            && !boundedSourceQueryAllowed
             && (context?.permissionMode === 'readonly' || protectedOperands.analysis.kind === 'unproven');
         if (lClassDenied) {
             logger.warn(`[L-Class Protection] L-class shell access denied: tool=${toolName} ` +
@@ -1789,23 +2015,15 @@ export function checkBlacklist(toolName, input) {
         if (!cmd || cmd.trim() === '') {
             return { behavior: 'allow', updatedInput: input };
         }
-        if (containsNetStopCommand(cmd)) {
+        // 只根据解析后的 executable 和 argv 判断，避免把搜索词、正则和
+        // heredoc/script 正文当成实际命令。
+        if (containsNetStopCommand(cmd) || containsAbsoluteForbiddenCommand(cmd)) {
             const cmdPreview = cmd.length > 60 ? cmd.substring(0, 60) + '...' : cmd;
             return {
                 behavior: 'deny',
                 message: `🚫 系统级危险操作已拦截\n命令：${cmdPreview}\n\n此类操作可能导致系统损坏，任何权限模式下都不允许执行。`,
             };
         }
-        // 检查绝对禁止命令（系统级破坏操作）
-        for (const pattern of ABSOLUTE_FORBIDDEN) {
-            if (pattern.test(cmd)) {
-                const cmdPreview = cmd.length > 60 ? cmd.substring(0, 60) + '...' : cmd;
-                return {
-                    behavior: 'deny',
-                    message: `🚫 系统级危险操作已拦截\n命令：${cmdPreview}\n\n此类操作可能导致系统损坏，任何权限模式下都不允许执行。`
-                };
-            }
-        }
     }
     // 默认允许
     return { behavior: 'allow', updatedInput: input };
@@ -1966,7 +2184,31 @@ export function evaluateToolPreflight(toolName, input, context) {
                 policyCode: 'managed_ec_discovery_forbidden',
             };
         }
-        const argv = context.sessionId ? parseCodexToolCommandArgv(input) : null;
+        const parserOptions = {
+            verifyShellExecutable: process.platform === 'win32',
+            ...(context.delegationCarrier
+                ? { expectedDelegationToken: context.delegationCarrier }
+                : {}),
+        };
+        const parsedCodex = context.sessionId ? parseCodexToolCommand(input, parserOptions) : null;
+        if (context.sessionId && parsedCodex && !parsedCodex.ok && parsedCodex.issue === 'untrusted-shell') {
+            return {
+                behavior: 'deny',
+                input,
+                message: '🔒 Shell 可执行文件未通过 Windows Authenticode 签名校验，禁止进入 EvolCore EC 特权路径。',
+                policyCode: 'ec_shell_untrusted_executable',
+            };
+        }
+        if (context.sessionId && parsedCodex?.ok && parsedCodex.delegationToken
+            && !context.delegationCarrier) {
+            return {
+                behavior: 'deny',
+                input,
+                message: '🔒 PowerShell 命令中的 EVOLCORE_DELEGATION_TOKEN 必须与当前托管 thread carrier 绑定；无法确认时拒绝执行。',
+                policyCode: 'delegation_token_unbound',
+            };
+        }
+        const argv = parsedCodex?.ok ? parsedCodex.argv : null;
         const managedAidArgv = argv?.at(-2) === '--format' && argv.at(-1) === 'json'
             ? argv.slice(0, -2)
             : argv;
@@ -2003,9 +2245,18 @@ export function evaluateToolPreflight(toolName, input, context) {
         }
         const shellDialect = stringShellCarrier?.dialect
             ?? (hasCodexCmdCarrierEcIntent(input) ? 'cmd' : undefined);
-        const ecCommand = classifyEvolcoreShellCommand(policyCommand, shellDialect
-            ? { dialect: shellDialect }
-            : {});
+        const hasPowerShellCarrierAssignment = stringShellCarrier?.dialect === 'powershell'
+            && hasPowerShellDelegationAssignment(stringShellCarrier.command);
+        const ecCommand = hasPowerShellCarrierAssignment && parsedCodex
+            ? parsedCodex.ok && parsedCodex.argv[0] === 'ec'
+                ? { kind: 'literal' }
+                : {
+                    kind: 'composite',
+                    issue: parsedCodex.ok ? 'shell-composition' : parsedCodex.issue,
+                }
+            : classifyEvolcoreShellCommand(policyCommand, shellDialect
+                ? { dialect: shellDialect, ...parserOptions }
+                : parserOptions);
         if (ecCommand.kind === 'literal') {
             return { behavior: 'allow', input, reason: 'ec-command' };
         }
@@ -2013,6 +2264,14 @@ export function evaluateToolPreflight(toolName, input, context) {
             return prepareBoundedOutputInput(input, ecCommand.command, 'ec', context);
         }
         if (ecCommand.kind === 'composite') {
+            if (ecCommand.issue === 'untrusted-shell') {
+                return {
+                    behavior: 'deny',
+                    input,
+                    message: '🔒 Shell 可执行文件未通过 Windows Authenticode 签名校验，禁止进入 EvolCore EC 特权路径。',
+                    policyCode: 'ec_shell_untrusted_executable',
+                };
+            }
             if (ecCommand.issue === 'unsafe-expansion') {
                 const message = shellDialect === 'powershell'
                     ? '🔒 EC 双引号正文包含未转义的 PowerShell 展开；纯文字请优先使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。PowerShell 传给 ec 时会还原为原文字面量'
@@ -2095,6 +2354,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         workspacePath: context.workspacePath,
         root: context.root,
         managedTempDir: context.managedTempDir,
+        allowReadonlySourceDiagnostics: context.allowReadonlySourceDiagnostics,
     });
     if (lClass.behavior === 'deny') {
         return { behavior: 'deny', input: checkedInput, message: lClass.message, policyCode: 'l_class_protection', matchedPath: lClass.matchedPath };

package/dist/core/runtime-lock.js

@@ -41,28 +41,33 @@ function isTrustedRuntimeLockDir(candidate) {
     if (!isWithinTmp && !isManagedSessionSibling)
         return false;
     try {
+        // Windows Stats.mode does not describe ACL privacy. The managed runtime
+        // roots are protected by Windows ACL inheritance, so apply POSIX
+        // ownership and permission-bit checks only where those fields are
+        // meaningful.
+        const isWindows = process.platform === 'win32';
         const tmpStat = fs.lstatSync(resolvedTmpRoot);
         if (!tmpStat.isDirectory() || tmpStat.isSymbolicLink())
             return false;
-        if (typeof process.getuid === 'function' && tmpStat.uid !== process.getuid())
+        if (!isWindows && typeof process.getuid === 'function' && tmpStat.uid !== process.getuid())
             return false;
-        if ((tmpStat.mode & 0o077) !== 0)
+        if (!isWindows && (tmpStat.mode & 0o077) !== 0)
             return false;
         if (isManagedSessionSibling) {
             const parentStat = fs.lstatSync(tmpParent);
             if (!parentStat.isDirectory() || parentStat.isSymbolicLink())
                 return false;
-            if (typeof process.getuid === 'function' && parentStat.uid !== process.getuid())
+            if (!isWindows && typeof process.getuid === 'function' && parentStat.uid !== process.getuid())
                 return false;
-            if ((parentStat.mode & 0o077) !== 0)
+            if (!isWindows && (parentStat.mode & 0o077) !== 0)
                 return false;
         }
         const stat = fs.lstatSync(resolved);
         if (!stat.isDirectory() || stat.isSymbolicLink())
             return false;
-        if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+        if (!isWindows && typeof process.getuid === 'function' && stat.uid !== process.getuid())
             return false;
-        return (stat.mode & 0o077) === 0;
+        return isWindows || (stat.mode & 0o077) === 0;
     }
     catch {
         return false;
@@ -93,8 +98,8 @@ export function ensureManagedLockParent(lockPath) {
         }
         const stat = fs.lstatSync(current);
         if (!stat.isDirectory() || stat.isSymbolicLink()
-            || (typeof process.getuid === 'function' && stat.uid !== process.getuid())
-            || (stat.mode & 0o077) !== 0) {
+            || (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            || (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
             throw new Error(`managed runtime lock path is not a private real directory: ${current}`);
         }
     }