evolcore 0.0.22 → 0.0.23

package/dist/core/permission/approval-gateway.js

@@ -3,7 +3,7 @@ import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
 import { renderActionAsText } from '../interaction-router.js';
 import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from '../message/message-utils.js';
 import { logger } from '../../utils/logger.js';
-import { summarizeToolInput } from '../../utils/tool-summary.js';
+import { summarizeToolInput, summarizeToolInputForAudit } from '../../utils/tool-summary.js';
 import { createRootCausation, deriveCausation, normalizeCausation } from '../causation/context.js';
 import { recordCausationSpan } from '../causation/audit.js';
 import { checkDangerousCommand } from './tool-policy.js';
@@ -31,6 +31,7 @@ export async function requestDangerousCommandPermission(gateway, sessionId, tool
             agentName: context?.agentName,
             role: context?.role,
             taskId: context?.taskId,
+            summary: summarizeToolInputForAudit(toolName, input).slice(0, 512),
         });
         return { matched: true, decision: 'deny' };
     }
@@ -132,6 +133,7 @@ function truncateApprovalDetail(value) {
         ? `${trimmed.slice(0, APPROVAL_DETAIL_LIMIT - 3)}...`
         : trimmed;
 }
+/** Keep unattended execution anomalies useful without copying command values. */
 function structuredApprovalAuditSummary(input) {
     const fields = [...new Set(Object.keys(input)
             .map(key => key.replace(/[^A-Za-z0-9_.-]/g, '_').slice(0, 48))
@@ -459,6 +461,7 @@ export class PermissionGateway {
                 agentName: pending.agentName,
                 role: pending.role,
                 taskId: pending.taskId,
+                summary: pending.auditSummary,
             });
         }
         void this.notifyPermissionState(pending, approved
@@ -511,6 +514,7 @@ export class PermissionGateway {
             agentName: pending.agentName,
             role: pending.role,
             taskId: pending.taskId,
+            summary: pending.auditSummary,
         });
         if (notifyState) {
             const failure = permissionFailure(reason);
@@ -558,6 +562,7 @@ export class PermissionGateway {
     async requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation, grantMatch) {
         const approval = context.approvalRouting;
         const interactionRouter = context.interactionRouter;
+        const auditSummary = summarizeToolInputForAudit(challenge.toolName, challenge.toolInput).slice(0, 512);
         if (!approval || !interactionRouter) {
             await sendPrompt('当前会话权限不足，且没有可用的 owner 审批通道。');
             auditPermissionDecision({
@@ -571,6 +576,7 @@ export class PermissionGateway {
                 agentName: context.agentName,
                 role: context.role,
                 taskId: context.taskId,
+                summary: structuredApprovalAuditSummary(challenge.toolInput),
             });
             return 'deny';
         }
@@ -673,6 +679,7 @@ export class PermissionGateway {
                 interactionRouter,
                 causation: requestCausation,
                 permissionStateChanged: context.permissionStateChanged,
+                auditSummary,
             };
             this.crossSessionPending.set(requestId, pending);
             this.syncManagementRevalidationTimer();
@@ -788,6 +795,7 @@ export class PermissionGateway {
             agentName: pending.agentName,
             role: pending.role,
             taskId: pending.taskId,
+            summary: pending.auditSummary,
         });
         const decisionCausation = deriveCausation(pending.causation);
         recordCausationSpan(decisionCausation, 'permission.decision', {
@@ -815,6 +823,7 @@ export class PermissionGateway {
         const effectiveApproverPolicy = approverPolicy
             ?? context?.approvalRouting?.approverPolicy
             ?? 'requester';
+        const auditSummary = summarizeToolInputForAudit(toolName, toolInput).slice(0, 512);
         if (context?.approvalInteractionPolicy === 'deny') {
             const denialRequestId = `perm-policy-${randomUUID()}`;
             const anomaly = {
@@ -852,6 +861,7 @@ export class PermissionGateway {
                 agentName: context.agentName,
                 role: context.role,
                 taskId: context.taskId,
+                summary: auditSummary,
             });
             return 'deny';
         }
@@ -868,6 +878,7 @@ export class PermissionGateway {
                 agentName: context?.agentName,
                 role: context?.role,
                 taskId: context?.taskId,
+                summary: auditSummary,
             });
             return 'deny';
         }
@@ -942,6 +953,7 @@ export class PermissionGateway {
                 agentName: context.agentName,
                 role: context.role,
                 taskId: context.taskId,
+                summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
             });
             return 'deny';
         }
@@ -1006,6 +1018,7 @@ export class PermissionGateway {
                 permissionMode: context?.permissionMode,
                 role: context?.role,
                 taskId: context?.taskId,
+                auditSummary,
             };
             pending.timeout = setTimeout(() => {
                 this.failPendingPermission(sessionId, requestId, 'expired');
@@ -1136,6 +1149,7 @@ export class PermissionGateway {
                 agentName: pending.agentName,
                 role: pending.role,
                 taskId: pending.taskId,
+                summary: pending.auditSummary,
             });
         }
         this.eventBus?.publish({ type: 'permission:resolved', sessionId, requestId, toolName: pending.toolName, approved: normalizedDecision !== 'deny', ...(policyCode ? { decisionSource, policyCode } : { decisionSource }), causation: decisionCausation });
@@ -1213,6 +1227,7 @@ export class PermissionGateway {
                     agentName: pending.agentName,
                     role: pending.role,
                     taskId: pending.taskId,
+                    summary: pending.auditSummary,
                 });
                 this.pending.delete(requestId);
                 const decisionCausation = deriveCausation(pending.causation);

package/dist/core/permission/protected-paths.js

@@ -302,6 +302,7 @@ export function getLClassWritePatterns(root = resolveRoot()) {
 }
 const CLAUDE_PROTECTED_TARGET_LIMIT = 8192;
 const CLAUDE_GLOB_MAGIC = /[*?[\]]/;
+const CODEX_GLOB_MAGIC = /[*?[\]]/;
 function addExistingTarget(targets, value) {
     try {
         const stat = fs.lstatSync(value);
@@ -427,12 +428,70 @@ export function buildClaudeProtectedFilesystem(root = resolveRoot(), options = {
     };
 }
 export function buildCodexHClassFilesystemRules(root = resolveRoot()) {
-    return {
+    const filesystem = {
         // Codex pre-expands unbounded deny globs on Linux/WSL/Windows. Without a
         // bound, patterns such as **/*.json_ are accepted but may not be enforced.
         glob_scan_max_depth: 64,
-        ...Object.fromEntries(getHClassSandboxPatterns(root).map(pattern => [pattern, 'deny'])),
+        ...Object.fromEntries(filterWindowsCodexFilesystemTargets(getHClassSandboxPatterns(root)).map(pattern => [pattern, 'deny'])),
     };
+    return compactWindowsCodexFilesystemRules(filesystem);
+}
+/**
+ * Windows Codex sandbox setup materializes a path while applying its deny-read
+ * ACL.  A nonexistent exact file target can therefore become a directory on
+ * disk (for example `daemon.pid`).  Keep existing paths and globs, but omit
+ * nonexistent exact paths so the sandbox never creates the wrong filesystem
+ * object.  Non-Windows callers retain the historical rule set.
+ */
+export function filterWindowsCodexFilesystemTargets(patterns, platform = process.platform) {
+    if (platform !== 'win32')
+        return patterns;
+    return patterns.filter(pattern => {
+        if (CODEX_GLOB_MAGIC.test(pattern))
+            return true;
+        try {
+            fs.lstatSync(pattern);
+            return true;
+        }
+        catch (error) {
+            const code = error && typeof error === 'object' && 'code' in error
+                ? error.code
+                : undefined;
+            return code === 'ENOENT' ? false : true;
+        }
+    });
+}
+/**
+ * Codex expands recursive deny globs into individual targets. Large protected
+ * trees on Windows can then fail during AGENTS.md loading with os error 206.
+ * Directory denies inherit to descendants through the Windows sandbox ACLs,
+ * avoiding redundant targets. Keep broad recursive filename globs intact.
+ */
+export function compactWindowsCodexFilesystemRules(filesystem, platform = process.platform) {
+    if (platform !== 'win32')
+        return filesystem;
+    const compacted = {};
+    for (const [pattern, access] of Object.entries(filesystem)) {
+        const isTerminalRecursiveDeny = access === 'deny'
+            && (pattern.endsWith('/**') || pattern.endsWith('\\**'));
+        const recursiveRoot = isTerminalRecursiveDeny ? pattern.slice(0, -3) : undefined;
+        // Only collapse a recursive deny when its root is a real directory.  A
+        // missing root must remain a glob: turning it into an exact target can
+        // make the Windows sandbox materialize that path as a directory.
+        const canCompact = !!recursiveRoot
+            && (CODEX_GLOB_MAGIC.test(recursiveRoot) || (() => {
+                try {
+                    return fs.lstatSync(recursiveRoot).isDirectory();
+                }
+                catch {
+                    return false;
+                }
+            })());
+        const compactPattern = canCompact ? recursiveRoot : pattern;
+        if (compacted[compactPattern] !== 'deny')
+            compacted[compactPattern] = access;
+    }
+    return compacted;
 }
 export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options = {}) {
     const lClassRules = {};
@@ -459,10 +518,10 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
             lClassRules[target.path] = lClassAccess;
         }
     }
-    return {
+    return compactWindowsCodexFilesystemRules({
         ...buildCodexHClassFilesystemRules(root),
         ...lClassRules,
-    };
+    });
 }
 export function hClassGrantIncludesProtectedPath(value, options = {}) {
     const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());

package/dist/core/permission/sandbox-runtime.js

@@ -497,8 +497,10 @@ export function buildHClassGuardCommand(executable, executableArgs, root = resol
         '--dev-bind', '/dev', '/dev',
         '--proc', '/proc',
     ];
-    appendLClassReadOnlyBinds(args, path.resolve(root));
-    appendHClassMasks(args, path.resolve(root), true);
+    if (options.protectEvolcoreFilesystem !== false) {
+        appendLClassReadOnlyBinds(args, path.resolve(root));
+        appendHClassMasks(args, path.resolve(root), true);
+    }
     if (options.managedCodexRequirements) {
         const requirements = path.resolve(options.managedCodexRequirements);
         if (!fs.statSync(requirements).isFile()) {

package/dist/core/permission/tool-policy.js

@@ -91,15 +91,179 @@ export function maskManagedTempShellPaths(command, options = {}) {
         return `__managed_tmp_${index}__`;
     });
 }
-// 绝对禁止命令（所有角色、所有权限模式下都禁止，不可授权）
-// 这些是系统级破坏操作，任何情况下都不应该允许
 const ABSOLUTE_FORBIDDEN = [
-    /\bshutdown\b/, // 关机
-    /\breboot\b/, // 重启
-    /\bmkfs\b/, // mkfs (格式化文件系统)
-    /\bformat\s+[a-zA-Z]:/i, // format C: (格式化磁盘)
-    /\bdd\s+if=.*of=\/dev/, // dd 写入磁盘设备（读取操作允许）
+    /\bshutdown\b/i,
+    /\breboot\b/i,
+    /\bmkfs(?:\.[A-Za-z0-9._-]+)?\b/i,
+    /\bformat\s+[a-zA-Z]:/i,
+    /\bdd\s+if=.*of=\/dev(?:\/|\b)/i,
 ];
+const SCRIPT_EXECUTION_RE = /(?:\bos\.system\s*\(|\bsubprocess\.(?:run|call|Popen)\s*\(|\bchild_process\.(?:exec|spawn|fork)\s*\(|\b(?:system|exec|spawn|popen)\s*\()/i;
+function hereDocDelimiter(line) {
+    let quote;
+    let escaped = false;
+    for (let index = 0; index < line.length - 1; index++) {
+        const char = line[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\' && quote !== 'single') {
+            escaped = true;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = undefined;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '"')
+                quote = undefined;
+            continue;
+        }
+        if (char === "'") {
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            continue;
+        }
+        if (char !== '<' || line[index + 1] !== '<' || line[index + 2] === '<')
+            continue;
+        let cursor = index + 2;
+        if (line[cursor] === '-')
+            cursor++;
+        while (cursor < line.length && /\s/.test(line[cursor]))
+            cursor++;
+        if (line[cursor] === "'" || line[cursor] === '"') {
+            const delimiterQuote = line[cursor++];
+            const start = cursor;
+            while (cursor < line.length && line[cursor] !== delimiterQuote)
+                cursor++;
+            return cursor > start && cursor < line.length ? line.slice(start, cursor) : undefined;
+        }
+        const match = line.slice(cursor).match(/^[A-Za-z_][A-Za-z0-9_-]*/);
+        return match?.[0];
+    }
+    return undefined;
+}
+function splitHereDocBodies(command) {
+    const lines = command.split(/\r?\n/);
+    let delimiter;
+    let body;
+    const bodies = [];
+    const retained = [];
+    for (const line of lines) {
+        if (delimiter) {
+            const candidate = line.replace(/^\t+/, '').trim();
+            if (candidate === delimiter) {
+                bodies.push((body ?? []).join('\n'));
+                delimiter = undefined;
+                body = undefined;
+            }
+            else {
+                body?.push(line);
+            }
+            continue;
+        }
+        retained.push(line);
+        delimiter = hereDocDelimiter(line);
+        if (delimiter)
+            body = [];
+    }
+    if (delimiter && body)
+        bodies.push(body.join('\n'));
+    return { command: retained.join('\n'), bodies };
+}
+function containsAbsoluteForbiddenText(value) {
+    return ABSOLUTE_FORBIDDEN.some(pattern => pattern.test(value));
+}
+function interpreterScript(args) {
+    const index = args.findIndex(argument => argument === '-c' || argument === '-e' || argument === '--eval');
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function scriptContainsAbsoluteForbidden(script) {
+    return SCRIPT_EXECUTION_RE.test(script) && containsAbsoluteForbiddenText(script);
+}
+/** Match only executable argv, never regex/search text or script literals. */
+function containsAbsoluteForbiddenCommand(command, depth = 0) {
+    const hereDocs = splitHereDocBodies(command);
+    if (containsShellSubstitution(hereDocs.command) && containsAbsoluteForbiddenText(hereDocs.command))
+        return true;
+    return splitShellCommandSegments(hereDocs.command).some(segment => {
+        const parsed = parseEffectiveCommand(segment);
+        if (!parsed)
+            return false;
+        const { executable, args } = parsed;
+        if (executable === 'shutdown' || executable === 'reboot')
+            return true;
+        if (/^mkfs(?:\..*)?$/.test(executable))
+            return true;
+        if (executable === 'format' && args.some(argument => /^[A-Za-z]:$/.test(argument)))
+            return true;
+        if (executable === 'dd'
+            && args.some(argument => /^if=/.test(argument))
+            && args.some(argument => /^of=\/dev(?:\/|$)/.test(argument)))
+            return true;
+        if (executable === 'eval' && containsAbsoluteForbiddenText(args.join(' ')))
+            return true;
+        if (['node', 'nodejs', 'python', 'python3', 'perl'].includes(executable)) {
+            const script = interpreterScript(args);
+            if (script && scriptContainsAbsoluteForbidden(script))
+                return true;
+            if (hereDocs.bodies.some(scriptContainsAbsoluteForbidden))
+                return true;
+        }
+        if (['bash', 'sh', 'zsh', 'dash'].includes(executable)
+            && hereDocs.bodies.some(body => containsAbsoluteForbiddenCommand(body, depth + 1)))
+            return true;
+        if (depth >= 2 || !['bash', 'sh', 'zsh', 'dash', 'cmd', 'cmd.exe'].includes(executable))
+            return false;
+        const commandFlag = executable.startsWith('cmd') ? '/c' : '-c';
+        const commandIndex = args.findIndex(argument => argument.toLowerCase() === commandFlag);
+        return commandIndex >= 0
+            && !!args[commandIndex + 1]
+            && containsAbsoluteForbiddenCommand(args.slice(commandIndex + 1).join(' '), depth + 1);
+    });
+}
+function containsShellSubstitution(command) {
+    let quote;
+    let escaped = false;
+    for (let index = 0; index < command.length; index++) {
+        const char = command[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\' && quote !== 'single') {
+            escaped = true;
+            continue;
+        }
+        if (quote === 'single') {
+            if (char === "'")
+                quote = undefined;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '"')
+                quote = undefined;
+            continue;
+        }
+        if (char === "'") {
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            continue;
+        }
+        if (char === '`' || (char === '$' && command[index + 1] === '('))
+            return true;
+    }
+    return false;
+}
 // 危险操作（需要用户审批才能执行）
 // 这些操作有合理使用场景，但需要用户明确授权
 const DANGEROUS_PATTERNS = [
@@ -386,7 +550,8 @@ function classifyStructuredCommand(command, depth = 0) {
     return matches.find(match => match.approvalScope === 'all') ?? matches[0];
 }
 function containsNetStopCommand(command, depth = 0) {
-    return splitShellCommandSegments(command).some(segment => {
+    const hereDocs = splitHereDocBodies(command);
+    return splitShellCommandSegments(hereDocs.command).some(segment => {
         const parsed = parseEffectiveCommand(segment);
         if (!parsed)
             return false;
@@ -394,6 +559,9 @@ function containsNetStopCommand(command, depth = 0) {
             && parsed.args[0]?.toLowerCase() === 'stop') {
             return true;
         }
+        if (['bash', 'sh', 'zsh', 'dash'].includes(parsed.executable)
+            && hereDocs.bodies.some(body => containsNetStopCommand(body, depth + 1)))
+            return true;
         if (depth >= 2 || !['bash', 'sh', 'zsh', 'dash', 'cmd', 'cmd.exe'].includes(parsed.executable)) {
             return false;
         }
@@ -1192,6 +1360,54 @@ function readonlySourceDiagnosticAllowed(analysis, projectPath) {
             && !isLClassPath(candidate, { root: resolveRoot() });
     });
 }
+/**
+ * A narrow exception for the common repository source inventory query. The
+ * general recursive H-class rule remains fail-closed; only an opt-in,
+ * single-find query whose output is limited to TypeScript/JavaScript files at
+ * the project root can use this path.
+ */
+function boundedRootSourceEnumeration(analysis, projectPath) {
+    if (analysis.kind !== 'proven-readonly' || analysis.ir.pipelines.length !== 1)
+        return false;
+    const pipeline = analysis.ir.pipelines[0];
+    const find = pipeline[0];
+    if (!find || find.executable !== 'find' || find.pathOperands.length !== 1 || find.pathOperands[0].access !== 'recursive') {
+        return false;
+    }
+    const workspace = resolveProtectedCandidate(projectPath);
+    if (workspace === path.parse(workspace).root)
+        return false;
+    const scope = resolveProtectedCandidate(find.pathOperands[0].value, projectPath);
+    if (scope !== workspace)
+        return false;
+    const allowedPredicates = new Set(['-o', '-or', '-a', '-and', '-print', '-print0']);
+    let sawSourceSuffix = false;
+    const scopeIndex = find.argv.indexOf(find.pathOperands[0].value);
+    if (scopeIndex < 1)
+        return false;
+    const args = find.argv.slice(scopeIndex + 1);
+    for (let index = 0; index < args.length; index++) {
+        const argument = args[index];
+        if (argument === '-name' || argument === '-iname') {
+            const pattern = args[++index];
+            if (!pattern || !/^\*\.(?:ts|js)$/i.test(pattern))
+                return false;
+            sawSourceSuffix = true;
+            continue;
+        }
+        if (argument === '-type') {
+            if (args[++index] !== 'f')
+                return false;
+            continue;
+        }
+        if (!allowedPredicates.has(argument))
+            return false;
+    }
+    if (!sawSourceSuffix)
+        return false;
+    return pipeline.slice(1).every(command => ['head', 'sort', 'grep', 'wc'].includes(command.executable)
+        && command.pathOperands.length === 0);
+}
 /** A lock filename used as a query pattern is safe; an operand naming the
  * actual lock path is still protected. */
 function containsLockPathReference(value) {
@@ -1246,10 +1462,13 @@ export function checkReadonly(toolName, input, projectPath, context) {
             managedTempDir,
             allowProtectedMetadata: context?.allowProtectedMetadata,
         });
+        const sourceQueryAllowed = readonlySourceDiagnosticAllowed(protectedOperands.analysis, projectPath);
+        const boundedSourceQueryAllowed = boundedRootSourceEnumeration(protectedOperands.analysis, projectPath);
         const sourceDiagnosticAllowed = context?.allowReadonlySourceDiagnostics
-            && readonlySourceDiagnosticAllowed(protectedOperands.analysis, projectPath)
-            && !protectedOperands.lClass
-            && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass));
+            && (!protectedOperands.lClass || boundedSourceQueryAllowed)
+            && ((sourceQueryAllowed
+                && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass)))
+                || boundedSourceQueryAllowed);
         if (sourceDiagnosticAllowed) {
             return { behavior: 'allow' };
         }
@@ -1556,11 +1775,15 @@ export function checkHClassWrite(toolName, input, context) {
             managedTempDir: context?.managedTempDir,
             allowProtectedMetadata: context?.allowProtectedMetadata,
         });
+        const sourceDiagnosticProjectPath = context?.projectPath ?? process.cwd();
+        const sourceQueryAllowed = readonlySourceDiagnosticAllowed(protectedOperands.analysis, sourceDiagnosticProjectPath);
+        const boundedSourceQueryAllowed = boundedRootSourceEnumeration(protectedOperands.analysis, sourceDiagnosticProjectPath);
         const sourceDiagnosticAllowed = context?.permissionMode === 'readonly'
             && context.allowReadonlySourceDiagnostics === true
-            && readonlySourceDiagnosticAllowed(protectedOperands.analysis, context.projectPath ?? process.cwd())
-            && !protectedOperands.lClass
-            && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass));
+            && (!protectedOperands.lClass || boundedSourceQueryAllowed)
+            && ((sourceQueryAllowed
+                && (!protectedOperands.hClass || (protectedOperands.lockDiagnostic && !protectedOperands.pathHClass)))
+                || boundedSourceQueryAllowed);
         if (protectedOperands.hClass && !sourceDiagnosticAllowed) {
             logger.warn(`[H-Class Protection] 🔒 Protected filesystem operand in shell command: tool=${toolName} ` +
                 `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
@@ -1721,7 +1944,10 @@ export function checkLClassWrite(toolName, input, context) {
             ...pathOptions,
             managedTempDir: context?.managedTempDir,
         });
+        const boundedSourceQueryAllowed = context?.allowReadonlySourceDiagnostics === true
+            && boundedRootSourceEnumeration(protectedOperands.analysis, context?.projectPath ?? process.cwd());
         const lClassDenied = protectedOperands.lClass
+            && !boundedSourceQueryAllowed
             && (context?.permissionMode === 'readonly' || protectedOperands.analysis.kind === 'unproven');
         if (lClassDenied) {
             logger.warn(`[L-Class Protection] L-class shell access denied: tool=${toolName} ` +
@@ -1789,23 +2015,15 @@ export function checkBlacklist(toolName, input) {
         if (!cmd || cmd.trim() === '') {
             return { behavior: 'allow', updatedInput: input };
         }
-        if (containsNetStopCommand(cmd)) {
+        // 只根据解析后的 executable 和 argv 判断，避免把搜索词、正则和
+        // heredoc/script 正文当成实际命令。
+        if (containsNetStopCommand(cmd) || containsAbsoluteForbiddenCommand(cmd)) {
             const cmdPreview = cmd.length > 60 ? cmd.substring(0, 60) + '...' : cmd;
             return {
                 behavior: 'deny',
                 message: `🚫 系统级危险操作已拦截\n命令：${cmdPreview}\n\n此类操作可能导致系统损坏，任何权限模式下都不允许执行。`,
             };
         }
-        // 检查绝对禁止命令（系统级破坏操作）
-        for (const pattern of ABSOLUTE_FORBIDDEN) {
-            if (pattern.test(cmd)) {
-                const cmdPreview = cmd.length > 60 ? cmd.substring(0, 60) + '...' : cmd;
-                return {
-                    behavior: 'deny',
-                    message: `🚫 系统级危险操作已拦截\n命令：${cmdPreview}\n\n此类操作可能导致系统损坏，任何权限模式下都不允许执行。`
-                };
-            }
-        }
     }
     // 默认允许
     return { behavior: 'allow', updatedInput: input };
@@ -2136,6 +2354,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         workspacePath: context.workspacePath,
         root: context.root,
         managedTempDir: context.managedTempDir,
+        allowReadonlySourceDiagnostics: context.allowReadonlySourceDiagnostics,
     });
     if (lClass.behavior === 'deny') {
         return { behavior: 'deny', input: checkedInput, message: lClass.message, policyCode: 'l_class_protection', matchedPath: lClass.matchedPath };

package/dist/core/runtime-lock.js

@@ -41,28 +41,33 @@ function isTrustedRuntimeLockDir(candidate) {
     if (!isWithinTmp && !isManagedSessionSibling)
         return false;
     try {
+        // Windows Stats.mode does not describe ACL privacy. The managed runtime
+        // roots are protected by Windows ACL inheritance, so apply POSIX
+        // ownership and permission-bit checks only where those fields are
+        // meaningful.
+        const isWindows = process.platform === 'win32';
         const tmpStat = fs.lstatSync(resolvedTmpRoot);
         if (!tmpStat.isDirectory() || tmpStat.isSymbolicLink())
             return false;
-        if (typeof process.getuid === 'function' && tmpStat.uid !== process.getuid())
+        if (!isWindows && typeof process.getuid === 'function' && tmpStat.uid !== process.getuid())
             return false;
-        if ((tmpStat.mode & 0o077) !== 0)
+        if (!isWindows && (tmpStat.mode & 0o077) !== 0)
             return false;
         if (isManagedSessionSibling) {
             const parentStat = fs.lstatSync(tmpParent);
             if (!parentStat.isDirectory() || parentStat.isSymbolicLink())
                 return false;
-            if (typeof process.getuid === 'function' && parentStat.uid !== process.getuid())
+            if (!isWindows && typeof process.getuid === 'function' && parentStat.uid !== process.getuid())
                 return false;
-            if ((parentStat.mode & 0o077) !== 0)
+            if (!isWindows && (parentStat.mode & 0o077) !== 0)
                 return false;
         }
         const stat = fs.lstatSync(resolved);
         if (!stat.isDirectory() || stat.isSymbolicLink())
             return false;
-        if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+        if (!isWindows && typeof process.getuid === 'function' && stat.uid !== process.getuid())
             return false;
-        return (stat.mode & 0o077) === 0;
+        return isWindows || (stat.mode & 0o077) === 0;
     }
     catch {
         return false;
@@ -93,8 +98,8 @@ export function ensureManagedLockParent(lockPath) {
         }
         const stat = fs.lstatSync(current);
         if (!stat.isDirectory() || stat.isSymbolicLink()
-            || (typeof process.getuid === 'function' && stat.uid !== process.getuid())
-            || (stat.mode & 0o077) !== 0) {
+            || (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid())
+            || (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
             throw new Error(`managed runtime lock path is not a private real directory: ${current}`);
         }
     }