evolcore 0.0.22 → 0.0.24

package/dist/core/permission/approval-gateway.js

@@ -3,12 +3,12 @@ import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
 import { renderActionAsText } from '../interaction-router.js';
 import { buildEnvelope, isInteractionSendAccepted, sendInteractionPayload } from '../message/message-utils.js';
 import { logger } from '../../utils/logger.js';
-import { summarizeToolInput } from '../../utils/tool-summary.js';
+import { summarizeToolInput, summarizeToolInputForAudit } from '../../utils/tool-summary.js';
 import { createRootCausation, deriveCausation, normalizeCausation } from '../causation/context.js';
 import { recordCausationSpan } from '../causation/audit.js';
 import { checkDangerousCommand } from './tool-policy.js';
 import { resolveProtectedCandidate } from './protected-paths.js';
-import { auditPermissionDecision } from '../auth/authorization-audit.js';
+import { auditPermissionDecision, auditPermissionLifecycle } from '../auth/authorization-audit.js';
 export async function requestDangerousCommandPermission(gateway, sessionId, toolName, input, sendPrompt, context, grantScope = 'default', mode = 'request') {
     const dangerCheck = checkDangerousCommand(toolName, input);
     if (!dangerCheck.isDangerous) {
@@ -31,6 +31,7 @@ export async function requestDangerousCommandPermission(gateway, sessionId, tool
             agentName: context?.agentName,
             role: context?.role,
             taskId: context?.taskId,
+            summary: summarizeToolInputForAudit(toolName, input).slice(0, 512),
         });
         return { matched: true, decision: 'deny' };
     }
@@ -132,6 +133,7 @@ function truncateApprovalDetail(value) {
         ? `${trimmed.slice(0, APPROVAL_DETAIL_LIMIT - 3)}...`
         : trimmed;
 }
+/** Keep unattended execution anomalies useful without copying command values. */
 function structuredApprovalAuditSummary(input) {
     const fields = [...new Set(Object.keys(input)
             .map(key => key.replace(/[^A-Za-z0-9_.-]/g, '_').slice(0, 48))
@@ -446,21 +448,40 @@ export class PermissionGateway {
         if (sessionGrant)
             this.addTemporaryGrant(pending, decisionCausation);
         pending.resolve(decision);
-        if (!approved) {
-            auditPermissionDecision({
-                requestId,
-                sessionId,
-                toolName: pending.toolName,
-                decisionSource: 'approval',
-                policyCode: 'user_approval_denied',
-                reason: 'owner approval denied',
-                permissionMode: pending.permissionMode,
-                agentAid: pending.selfAid,
-                agentName: pending.agentName,
-                role: pending.role,
-                taskId: pending.taskId,
-            });
-        }
+        auditPermissionLifecycle({
+            phase: 'response',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: approved ? 'allow' : 'deny',
+            decisionSource: 'approval',
+            policyCode: approved ? undefined : 'user_approval_denied',
+            reason: approved ? 'owner approval accepted' : 'owner approval denied',
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: action,
+        });
+        auditPermissionLifecycle({
+            phase: 'final',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: approved ? 'allow' : 'deny',
+            decisionSource: 'approval',
+            policyCode: approved ? undefined : 'user_approval_denied',
+            reason: approved ? 'owner approval accepted' : 'owner approval denied',
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: action,
+        });
         void this.notifyPermissionState(pending, approved
             ? { state: 'approved', requestId, toolName: pending.toolName }
             : {
@@ -499,6 +520,23 @@ export class PermissionGateway {
         pending.resolve('deny');
         const decisionSource = 'infrastructure';
         const policyCode = cancelled ? 'approval_cancelled' : `approval_${reason}`;
+        auditPermissionLifecycle({
+            phase: 'response',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: 'deny',
+            decisionSource,
+            policyCode,
+            reason,
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: reason,
+        });
         auditPermissionDecision({
             requestId,
             sessionId,
@@ -511,6 +549,7 @@ export class PermissionGateway {
             agentName: pending.agentName,
             role: pending.role,
             taskId: pending.taskId,
+            summary: pending.auditSummary,
         });
         if (notifyState) {
             const failure = permissionFailure(reason);
@@ -558,9 +597,28 @@ export class PermissionGateway {
     async requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation, grantMatch) {
         const approval = context.approvalRouting;
         const interactionRouter = context.interactionRouter;
+        const auditSummary = summarizeToolInputForAudit(challenge.toolName, challenge.toolInput).slice(0, 512);
         if (!approval || !interactionRouter) {
             await sendPrompt('当前会话权限不足，且没有可用的 owner 审批通道。');
+            auditPermissionLifecycle({
+                phase: 'response',
+                requestId: challenge.id,
+                sessionId,
+                toolName: challenge.toolName,
+                decision: 'deny',
+                decisionSource: 'infrastructure',
+                policyCode: 'approval_route_unavailable',
+                reason: 'owner approval routing context is unavailable',
+                permissionMode: context.permissionMode,
+                agentAid: context.selfAid,
+                agentName: context.agentName,
+                role: context.role,
+                taskId: context.taskId,
+                summary: auditSummary,
+                response: 'unavailable',
+            });
             auditPermissionDecision({
+                requestId: challenge.id,
                 sessionId,
                 toolName: challenge.toolName,
                 decisionSource: 'infrastructure',
@@ -571,6 +629,7 @@ export class PermissionGateway {
                 agentName: context.agentName,
                 role: context.role,
                 taskId: context.taskId,
+                summary: structuredApprovalAuditSummary(challenge.toolInput),
             });
             return 'deny';
         }
@@ -673,6 +732,7 @@ export class PermissionGateway {
                 interactionRouter,
                 causation: requestCausation,
                 permissionStateChanged: context.permissionStateChanged,
+                auditSummary,
             };
             this.crossSessionPending.set(requestId, pending);
             this.syncManagementRevalidationTimer();
@@ -776,6 +836,23 @@ export class PermissionGateway {
         this.syncManagementRevalidationTimer();
         pending.resolve('deny');
         const decisionSource = reason === 'denied' ? 'approval' : 'infrastructure';
+        auditPermissionLifecycle({
+            phase: 'response',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: 'deny',
+            decisionSource,
+            policyCode: `approval_${reason}`,
+            reason,
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: reason,
+        });
         auditPermissionDecision({
             requestId,
             sessionId,
@@ -788,6 +865,7 @@ export class PermissionGateway {
             agentName: pending.agentName,
             role: pending.role,
             taskId: pending.taskId,
+            summary: pending.auditSummary,
         });
         const decisionCausation = deriveCausation(pending.causation);
         recordCausationSpan(decisionCausation, 'permission.decision', {
@@ -815,6 +893,7 @@ export class PermissionGateway {
         const effectiveApproverPolicy = approverPolicy
             ?? context?.approvalRouting?.approverPolicy
             ?? 'requester';
+        const auditSummary = summarizeToolInputForAudit(toolName, toolInput).slice(0, 512);
         if (context?.approvalInteractionPolicy === 'deny') {
             const denialRequestId = `perm-policy-${randomUUID()}`;
             const anomaly = {
@@ -852,6 +931,7 @@ export class PermissionGateway {
                 agentName: context.agentName,
                 role: context.role,
                 taskId: context.taskId,
+                summary: auditSummary,
             });
             return 'deny';
         }
@@ -868,6 +948,7 @@ export class PermissionGateway {
                 agentName: context?.agentName,
                 role: context?.role,
                 taskId: context?.taskId,
+                summary: auditSummary,
             });
             return 'deny';
         }
@@ -904,6 +985,20 @@ export class PermissionGateway {
             refs: { permissionRequestId: requestId, taskId: context.taskId, sessionId },
         });
         this.eventBus?.publish({ type: 'permission:requested', sessionId, requestId, toolName, input: displaySummary, causation: requestCausation });
+        auditPermissionLifecycle({
+            phase: 'request',
+            requestId,
+            sessionId,
+            toolName,
+            decision: 'pending',
+            decisionSource: 'approval',
+            permissionMode: context?.permissionMode,
+            agentAid: context?.selfAid,
+            agentName: context?.agentName,
+            role: context?.role,
+            taskId: context?.taskId,
+            summary: auditSummary,
+        });
         const route = planApprovalRoute(challenge, context);
         logger.info(`[PermissionGateway] approval_route request=${requestId} policy=${challenge.approverPolicy}`
             + ` route=${route.kind}`
@@ -942,6 +1037,24 @@ export class PermissionGateway {
                 agentName: context.agentName,
                 role: context.role,
                 taskId: context.taskId,
+                summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+            });
+            auditPermissionLifecycle({
+                phase: 'response',
+                requestId,
+                sessionId,
+                toolName,
+                decision: 'deny',
+                decisionSource: 'infrastructure',
+                policyCode: 'approval_route_unavailable',
+                reason: route.reason,
+                permissionMode: context.permissionMode,
+                agentAid: context.selfAid,
+                agentName: context.agentName,
+                role: context.role,
+                taskId: context.taskId,
+                summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
+                response: 'unavailable',
             });
             return 'deny';
         }
@@ -1006,6 +1119,7 @@ export class PermissionGateway {
                 permissionMode: context?.permissionMode,
                 role: context?.role,
                 taskId: context?.taskId,
+                auditSummary,
             };
             pending.timeout = setTimeout(() => {
                 this.failPendingPermission(sessionId, requestId, 'expired');
@@ -1112,6 +1226,40 @@ export class PermissionGateway {
         pending.resolve(normalizedDecision === 'deny' ? 'deny' : 'allow');
         this.pending.delete(requestId);
         this.syncManagementRevalidationTimer();
+        auditPermissionLifecycle({
+            phase: 'response',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: normalizedDecision === 'deny' ? 'deny' : 'allow',
+            decisionSource: 'approval',
+            policyCode: normalizedDecision === 'deny' ? 'user_approval_denied' : undefined,
+            reason: normalizedDecision === 'deny' ? 'user approval denied' : 'user approval accepted',
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: normalizedDecision,
+        });
+        auditPermissionLifecycle({
+            phase: 'final',
+            requestId,
+            sessionId,
+            toolName: pending.toolName,
+            decision: normalizedDecision === 'deny' ? 'deny' : 'allow',
+            decisionSource: 'approval',
+            policyCode: normalizedDecision === 'deny' ? 'user_approval_denied' : undefined,
+            reason: normalizedDecision === 'deny' ? 'user approval denied' : 'user approval accepted',
+            permissionMode: pending.permissionMode,
+            agentAid: pending.selfAid,
+            agentName: pending.agentName,
+            role: pending.role,
+            taskId: pending.taskId,
+            summary: pending.auditSummary,
+            response: normalizedDecision,
+        });
         const decisionCausation = deriveCausation(pending.causation);
         if (normalizedDecision === 'always') {
             this.addTemporaryGrant(pending, decisionCausation);
@@ -1123,21 +1271,6 @@ export class PermissionGateway {
         });
         const decisionSource = 'approval';
         const policyCode = normalizedDecision === 'deny' ? 'user_approval_denied' : undefined;
-        if (normalizedDecision === 'deny') {
-            auditPermissionDecision({
-                requestId,
-                sessionId,
-                toolName: pending.toolName,
-                decisionSource,
-                policyCode: 'user_approval_denied',
-                reason: 'user approval denied',
-                permissionMode: pending.permissionMode,
-                agentAid: pending.selfAid,
-                agentName: pending.agentName,
-                role: pending.role,
-                taskId: pending.taskId,
-            });
-        }
         this.eventBus?.publish({ type: 'permission:resolved', sessionId, requestId, toolName: pending.toolName, approved: normalizedDecision !== 'deny', ...(policyCode ? { decisionSource, policyCode } : { decisionSource }), causation: decisionCausation });
         return true;
     }
@@ -1201,6 +1334,23 @@ export class PermissionGateway {
                 this.clearPendingResources(pending);
                 pending.interactionRouter?.cancel(requestId, reason);
                 pending.resolve('deny');
+                auditPermissionLifecycle({
+                    phase: 'response',
+                    requestId,
+                    sessionId,
+                    toolName: pending.toolName,
+                    decision: 'deny',
+                    decisionSource: 'infrastructure',
+                    policyCode: `approval_${reason}`,
+                    reason,
+                    permissionMode: pending.permissionMode,
+                    agentAid: pending.selfAid,
+                    agentName: pending.agentName,
+                    role: pending.role,
+                    taskId: pending.taskId,
+                    summary: pending.auditSummary,
+                    response: reason,
+                });
                 auditPermissionDecision({
                     requestId,
                     sessionId,
@@ -1213,6 +1363,7 @@ export class PermissionGateway {
                     agentName: pending.agentName,
                     role: pending.role,
                     taskId: pending.taskId,
+                    summary: pending.auditSummary,
                 });
                 this.pending.delete(requestId);
                 const decisionCausation = deriveCausation(pending.causation);

package/dist/core/permission/protected-paths.js

@@ -302,6 +302,7 @@ export function getLClassWritePatterns(root = resolveRoot()) {
 }
 const CLAUDE_PROTECTED_TARGET_LIMIT = 8192;
 const CLAUDE_GLOB_MAGIC = /[*?[\]]/;
+const CODEX_GLOB_MAGIC = /[*?[\]]/;
 function addExistingTarget(targets, value) {
     try {
         const stat = fs.lstatSync(value);
@@ -427,12 +428,70 @@ export function buildClaudeProtectedFilesystem(root = resolveRoot(), options = {
     };
 }
 export function buildCodexHClassFilesystemRules(root = resolveRoot()) {
-    return {
+    const filesystem = {
         // Codex pre-expands unbounded deny globs on Linux/WSL/Windows. Without a
         // bound, patterns such as **/*.json_ are accepted but may not be enforced.
         glob_scan_max_depth: 64,
-        ...Object.fromEntries(getHClassSandboxPatterns(root).map(pattern => [pattern, 'deny'])),
+        ...Object.fromEntries(filterWindowsCodexFilesystemTargets(getHClassSandboxPatterns(root)).map(pattern => [pattern, 'deny'])),
     };
+    return compactWindowsCodexFilesystemRules(filesystem);
+}
+/**
+ * Windows Codex sandbox setup materializes a path while applying its deny-read
+ * ACL.  A nonexistent exact file target can therefore become a directory on
+ * disk (for example `daemon.pid`).  Keep existing paths and globs, but omit
+ * nonexistent exact paths so the sandbox never creates the wrong filesystem
+ * object.  Non-Windows callers retain the historical rule set.
+ */
+export function filterWindowsCodexFilesystemTargets(patterns, platform = process.platform) {
+    if (platform !== 'win32')
+        return patterns;
+    return patterns.filter(pattern => {
+        if (CODEX_GLOB_MAGIC.test(pattern))
+            return true;
+        try {
+            fs.lstatSync(pattern);
+            return true;
+        }
+        catch (error) {
+            const code = error && typeof error === 'object' && 'code' in error
+                ? error.code
+                : undefined;
+            return code === 'ENOENT' ? false : true;
+        }
+    });
+}
+/**
+ * Codex expands recursive deny globs into individual targets. Large protected
+ * trees on Windows can then fail during AGENTS.md loading with os error 206.
+ * Directory denies inherit to descendants through the Windows sandbox ACLs,
+ * avoiding redundant targets. Keep broad recursive filename globs intact.
+ */
+export function compactWindowsCodexFilesystemRules(filesystem, platform = process.platform) {
+    if (platform !== 'win32')
+        return filesystem;
+    const compacted = {};
+    for (const [pattern, access] of Object.entries(filesystem)) {
+        const isTerminalRecursiveDeny = access === 'deny'
+            && (pattern.endsWith('/**') || pattern.endsWith('\\**'));
+        const recursiveRoot = isTerminalRecursiveDeny ? pattern.slice(0, -3) : undefined;
+        // Only collapse a recursive deny when its root is a real directory.  A
+        // missing root must remain a glob: turning it into an exact target can
+        // make the Windows sandbox materialize that path as a directory.
+        const canCompact = !!recursiveRoot
+            && (CODEX_GLOB_MAGIC.test(recursiveRoot) || (() => {
+                try {
+                    return fs.lstatSync(recursiveRoot).isDirectory();
+                }
+                catch {
+                    return false;
+                }
+            })());
+        const compactPattern = canCompact ? recursiveRoot : pattern;
+        if (compacted[compactPattern] !== 'deny')
+            compacted[compactPattern] = access;
+    }
+    return compacted;
 }
 export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options = {}) {
     const lClassRules = {};
@@ -459,10 +518,10 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
             lClassRules[target.path] = lClassAccess;
         }
     }
-    return {
+    return compactWindowsCodexFilesystemRules({
         ...buildCodexHClassFilesystemRules(root),
         ...lClassRules,
-    };
+    });
 }
 export function hClassGrantIncludesProtectedPath(value, options = {}) {
     const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());

package/dist/core/permission/sandbox-runtime.js

@@ -497,8 +497,10 @@ export function buildHClassGuardCommand(executable, executableArgs, root = resol
         '--dev-bind', '/dev', '/dev',
         '--proc', '/proc',
     ];
-    appendLClassReadOnlyBinds(args, path.resolve(root));
-    appendHClassMasks(args, path.resolve(root), true);
+    if (options.protectEvolcoreFilesystem !== false) {
+        appendLClassReadOnlyBinds(args, path.resolve(root));
+        appendHClassMasks(args, path.resolve(root), true);
+    }
     if (options.managedCodexRequirements) {
         const requirements = path.resolve(options.managedCodexRequirements);
         if (!fs.statSync(requirements).isFile()) {