evolcore 0.0.24 → 0.0.26

package/dist/core/permission/ec-command-parser.js

@@ -183,6 +183,10 @@ function substituteManagedTmpDirToken(value) {
     }
     return result;
 }
+function containsManagedTmpDirReference(value) {
+    return /\$TMPDIR|\$\{TMPDIR\}/.test(value)
+        || /\$env:TMPDIR|\$\{env:TMPDIR\}/i.test(value);
+}
 function restoreManagedTmpDirToken(value, managedTempDir) {
     return value.replaceAll(MANAGED_TMPDIR_TOKEN, managedTempDir ?? '$TMPDIR');
 }
@@ -362,7 +366,7 @@ function parseFailure(issue, input, offset, tokenIndex, dialect) {
         inputLength: input.length,
     };
 }
-function parseLiteralPowerShellCommand(command) {
+function parseLiteralPowerShellCommand(command, options = {}) {
     const input = trimShellSpacing(command);
     if (!input)
         return parseFailure('empty-command', input, 0, 0, 'powershell');
@@ -372,6 +376,9 @@ function parseLiteralPowerShellCommand(command) {
     let token = '';
     let tokenStarted = false;
     let quote = null;
+    // Environment variable names are case-insensitive on Windows. Require a
+    // complete variable name, including PowerShell's Unicode/name characters.
+    const managedTmpDirReference = new RegExp('^\\$(?:env:TMPDIR(?![\\p{L}\\p{Nd}_?:])|\\{env:TMPDIR\\})', process.platform === 'win32' ? 'iu' : 'u');
     const finishToken = () => {
         if (!tokenStarted)
             return;
@@ -396,6 +403,23 @@ function parseLiteralPowerShellCommand(command) {
             }
             continue;
         }
+        if (char === '$' && isShellParameterExpansionStart(input[index + 1])) {
+            const reference = managedTmpDirReference.exec(input.slice(index))?.[0];
+            const next = reference ? input[index + reference.length] : undefined;
+            if (!reference) {
+                return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
+            }
+            if (!options.allowManagedTmpDir || !options.managedTempDir
+                || (next !== undefined && !/[\\/\s"']/u.test(next))) {
+                return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
+            }
+            // Append the registered value directly: spaces remain in this argument,
+            // and characters in the directory are never interpreted as shell syntax.
+            token += options.managedTempDir;
+            tokenStarted = true;
+            index += reference.length - 1;
+            continue;
+        }
         if (quote === 'double') {
             if (char === '"') {
                 if (!isLiteralArgBoundary(input[index + 1]))
@@ -412,9 +436,6 @@ function parseLiteralPowerShellCommand(command) {
                 token += next;
                 continue;
             }
-            if (char === '$' && isShellParameterExpansionStart(input[index + 1])) {
-                return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
-            }
             token += char;
             continue;
         }
@@ -729,7 +750,7 @@ function doubleQuotedIssueAt(input, index) {
  */
 export function parseLiteralShellCommand(command, options = {}) {
     if (options.dialect === 'powershell') {
-        return parseLiteralPowerShellCommand(command);
+        return parseLiteralPowerShellCommand(command, options);
     }
     if (options.dialect === 'cmd') {
         return parseLiteralCmdCommand(command, options);
@@ -1416,16 +1437,16 @@ export function parseCodexExecToolCommand(input) {
     }
     return decoded;
 }
-function parseProactiveToolCommandArgv(toolName, input) {
+function parseProactiveToolCommand(toolName, input) {
     const options = {
         verifyShellExecutable: process.platform === 'win32',
     };
     if (toolName === 'Bash' || toolName === 'Shell')
-        return parseCodexToolCommandArgv(input, options);
+        return parseCodexToolCommand(input, options);
     if (toolName !== 'exec')
         return null;
     const command = parseCodexExecToolCommand(input);
-    return command ? parseCodexShellCommandArgv(command, { allowManagedTmpDir: true, ...options }) : null;
+    return command ? parseCodexToolCommand({ command }, options) : null;
 }
 function scanBoundedOutputOperators(command) {
     const operators = [];
@@ -1711,13 +1732,13 @@ function findSingleFileOption(argv, startIndex) {
 const PROACTIVE_SEND_VALUE_FLAGS = new Set([
     '--format', '--app', '--file', '--text-from-file', '--link', '--payload',
     '--title', '--description', '--text', '--transcript', '--as',
-    '--content-type', '--mention', '--aun-path', '--thread', '--return',
+    '--content-type', '--mention', '--aun-path', '--thread', '--return', '--handoff-context',
 ]);
 const PROACTIVE_SEND_BOOLEAN_FLAGS = new Set([
     '--encrypt', '--no-encrypt', '--mention-all',
 ]);
 const SEND_CONTENT_VALUE_FLAGS = new Set([
-    '--payload', '--title', '--description', '--text', '--transcript',
+    '--payload', '--title', '--description', '--text', '--transcript', '--handoff-context',
 ]);
 const TRIGGER_CONTENT_VALUE_FLAGS = new Set(['--prompt']);
 /**
@@ -1728,7 +1749,7 @@ const TRIGGER_CONTENT_VALUE_FLAGS = new Set(['--prompt']);
  */
 export function containsLiteralManagedTmpDirOutsideSendContent(argv) {
     const literalIndexes = argv
-        .map((value, index) => value.includes('$TMPDIR') ? index : -1)
+        .map((value, index) => containsManagedTmpDirReference(value) ? index : -1)
         .filter(index => index >= 0);
     if (literalIndexes.length === 0)
         return false;
@@ -1903,7 +1924,8 @@ export function isExactEvolcoreSendCommandForSession(toolName, input, channelId,
     // is represented as `exec` and is handled only for one literal inner call.
     if (!selfAid)
         return false;
-    const argv = parseProactiveToolCommandArgv(toolName, input);
+    const result = parseProactiveToolCommand(toolName, input);
+    const argv = result?.ok ? result.argv : null;
     const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
     if (!parsed || parsed.action !== 'send')
         return false;
@@ -1914,3 +1936,20 @@ export function isExactEvolcoreSendCommandForSession(toolName, input, channelId,
         && !!argv
         && hasExecutableProactiveSendPayload(argv, expectedScope);
 }
+/** Diagnostic only: this never broadens the exact-send authorization check. */
+export function describeProactiveSendCommandFailure(toolName, input) {
+    if (!['Bash', 'Shell', 'exec'].includes(toolName) || !input || typeof input !== 'object')
+        return undefined;
+    const commandText = [input.command, input.input, ...(Array.isArray(input.commandArgv) ? input.commandArgv : [])]
+        .filter((value) => typeof value === 'string').join(' ');
+    if (!/\bec(?:\.cmd|\.exe)?\s+(?:group|msg)\s+send\b/i.test(commandText))
+        return undefined;
+    const result = parseProactiveToolCommand(toolName, input);
+    if (!result)
+        return '当前汇报命令未通过规范解析：只支持单次、字面量的发送调用，请将发送作为独立工具调用。';
+    if (!result.ok) {
+        return `当前汇报命令未通过规范解析（${result.issue}，${result.dialect}，位置 ${result.offset}）；`
+            + '请检查引号和转义，并将发送作为一条独立命令。';
+    }
+    return '当前汇报命令不符合当前会话的发送要求；请核对发送者、私聊或群目标，以及正文和参数。';
+}

package/dist/core/permission/sandbox-runtime.js

@@ -5,34 +5,55 @@ import { getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameO
 import { resolveRoot } from '../../paths.js';
 let cachedBubblewrapPath;
 let sandboxInitializationCircuit;
+const sessionSandboxInitializationCircuits = new Map();
 let sandboxCircuitNoticeAt = 0;
 export const SANDBOX_INITIALIZATION_FAILED = 'sandbox_initialization_failed';
 export const SANDBOX_INITIALIZATION_COOLDOWN_MS = 5 * 60 * 1000;
 export const SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS = 60 * 1000;
 const SANDBOX_DIAGNOSTIC_TARGET_LIMIT = 256;
-/** Open a process-wide fail-closed circuit after a confirmed host bootstrap failure. */
-export function recordSandboxInitializationFailure(error, stderr = [], now = Date.now()) {
+/** Host bootstrap failures open a process circuit; tool-result failures only
+ * affect their originating session because tool output is not host attestation. */
+export function recordSandboxInitializationFailure(error, stderr = [], now = Date.now(), sessionId) {
     const detail = createSandboxInitializationError(error, stderr).message.slice(0, 512);
-    sandboxInitializationCircuit = sandboxInitializationCircuit
+    getActiveSandboxInitializationFailure(now);
+    const previous = sessionId ? sessionSandboxInitializationCircuits.get(sessionId) : sandboxInitializationCircuit;
+    const circuit = previous
         ? {
-            ...sandboxInitializationCircuit,
+            ...previous,
             lastObservedAt: now,
-            occurrences: sandboxInitializationCircuit.occurrences + 1,
+            occurrences: previous.occurrences + 1,
             detail,
         }
         : { openedAt: now, lastObservedAt: now, occurrences: 1, detail };
-    return { ...sandboxInitializationCircuit };
-}
-/** Return an active failure circuit, or allow one probe after the cooldown. */
-export function getActiveSandboxInitializationFailure(now = Date.now(), cooldownMs = SANDBOX_INITIALIZATION_COOLDOWN_MS) {
-    if (!sandboxInitializationCircuit)
-        return undefined;
-    if (now - sandboxInitializationCircuit.lastObservedAt >= cooldownMs) {
+    if (sessionId)
+        sessionSandboxInitializationCircuits.set(sessionId, circuit);
+    else
+        sandboxInitializationCircuit = circuit;
+    return { ...circuit };
+}
+/** Expire old failures and return the process or requested session circuit. */
+export function getActiveSandboxInitializationFailure(now = Date.now(), cooldownMs = SANDBOX_INITIALIZATION_COOLDOWN_MS, sessionId) {
+    for (const [id, circuit] of sessionSandboxInitializationCircuits) {
+        if (now - circuit.lastObservedAt >= cooldownMs)
+            sessionSandboxInitializationCircuits.delete(id);
+    }
+    if (sandboxInitializationCircuit && now - sandboxInitializationCircuit.lastObservedAt >= cooldownMs) {
         sandboxInitializationCircuit = undefined;
         sandboxCircuitNoticeAt = 0;
-        return undefined;
     }
-    return { ...sandboxInitializationCircuit };
+    const circuit = sandboxInitializationCircuit ?? (sessionId ? sessionSandboxInitializationCircuits.get(sessionId) : undefined);
+    return circuit ? { ...circuit } : undefined;
+}
+/** Only recognize the complete native bootstrap diagnostic, never a quotation
+ * embedded in ordinary tool output. Tool-result evidence is session-scoped. */
+export function isSandboxInitializationToolResult(content) {
+    const text = typeof content === 'string'
+        ? content
+        : Array.isArray(content) && content.every(block => block?.type === 'text' && typeof block.text === 'string')
+            ? content.map(block => block.text).join('\n')
+            : '';
+    return /^(?:Exit code [1-9]\d*\r?\n)?apply-seccomp: write \/proc\/self\/(?:uid|gid)_map: (?:Operation not permitted|Permission denied)\s*$/i
+        .test(text.trim());
 }
 /** Rate-limit human-readable warnings; structured audit still records every blocked task. */
 export function shouldLogSandboxCircuitNotice(now = Date.now(), intervalMs = SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS) {
@@ -561,6 +582,7 @@ export function buildBubblewrapCommand(executable, executableArgs, options) {
     return { command: bubblewrapPath, args };
 }
 export function _resetSandboxRuntimeCache() {
+    sessionSandboxInitializationCircuits.clear();
     cachedBubblewrapPath = undefined;
     sandboxInitializationCircuit = undefined;
     sandboxCircuitNoticeAt = 0;

package/dist/core/permission/tool-policy.js

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import path from 'path';
+import os from 'os';
 import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
@@ -41,6 +42,14 @@ export function expandManagedTempPath(value, options = {}) {
 }
 const WRITE_INTENT_RE = /(?:^|[\s;&|])(?:mkdir|mktemp|touch|tee|cp|mv|install|chmod|chown|ln|rm)(?:[\s;&|]|$)|(?:^|[\s])(?:\d>>?|>>?)\s*/i;
 const TEMP_TOKEN_RE = /(?:\$TMPDIR|\$\{TMPDIR\}|\/tmp(?:\/|$)|\/var\/tmp(?:\/|$)|\/dev\/shm(?:\/|$))[^\s'";&|<>)]*/g;
+function windowsTempRoots(options) {
+    if (process.platform !== 'win32')
+        return [];
+    return [os.tmpdir(), options.env?.TEMP, options.env?.TMP, process.env.TEMP, process.env.TMP]
+        .filter((value) => typeof value === 'string' && path.isAbsolute(value))
+        .map(value => resolveProtectedCandidate(value))
+        .filter((value, index, values) => values.indexOf(value) === index);
+}
 /**
  * Inspect shell write targets that look like temporary paths. Ordinary
  * project writes are left to the existing workspace/H-class policy; any
@@ -52,19 +61,32 @@ export function checkManagedTempShellCommand(command, options = {}) {
     const root = resolveManagedTempDir(options.env);
     const normalized = substituteTmpDir(command, root);
     const candidates = [...normalized.matchAll(TEMP_TOKEN_RE)].map(match => match[0].replace(/[.,:]+$/, ''));
-    if (candidates.length === 0)
+    // Windows has no portable `/tmp` spelling. Treat absolute paths below the
+    // host temporary roots as temporary operands too, so a sibling session
+    // directory cannot bypass the managed TMPDIR check.
+    if (process.platform === 'win32') {
+        const roots = windowsTempRoots(options);
+        const windowsCandidates = normalized.match(/[A-Za-z]:[\\/][^\s'";&|<>)]*/g) ?? [];
+        for (const candidate of windowsCandidates) {
+            const canonical = resolveProtectedCandidate(candidate.replace(/[.,:]+$/, ''), options.cwd);
+            if (roots.some(root => isSameOrDescendant(canonical, root)))
+                candidates.push(candidate.replace(/[.,:]+$/, ''));
+        }
+    }
+    const uniqueCandidates = [...new Set(candidates)];
+    if (uniqueCandidates.length === 0)
         return { kind: 'none' };
     if (!root) {
-        return { kind: 'deny', paths: candidates, reason: 'TMPDIR is unset or not an absolute managed path' };
+        return { kind: 'deny', paths: uniqueCandidates, reason: 'TMPDIR is unset or not an absolute managed path' };
     }
-    const outside = candidates.filter(candidate => !isManagedTempPath(candidate, {
+    const outside = uniqueCandidates.filter(candidate => !isManagedTempPath(candidate, {
         ...options,
         env: { ...(options.env ?? process.env), TMPDIR: root },
     }));
     if (outside.length > 0) {
         return { kind: 'deny', paths: outside, reason: 'temporary write target is outside the session-managed TMPDIR' };
     }
-    return { kind: 'allow', paths: candidates };
+    return { kind: 'allow', paths: uniqueCandidates };
 }
 /**
  * Replace only already-validated temporary path operands before a second
@@ -2187,6 +2209,7 @@ export function evaluateToolPreflight(toolName, input, context) {
         }
         const parserOptions = {
             verifyShellExecutable: process.platform === 'win32',
+            managedTempDir: context.managedTempDir,
             ...(context.delegationCarrier
                 ? { expectedDelegationToken: context.delegationCarrier }
                 : {}),
@@ -2237,16 +2260,33 @@ export function evaluateToolPreflight(toolName, input, context) {
             && managedAidArgv[2] === 'agentmd'
             && managedAidArgv[3] === 'put'
             && ownAid;
+        const avatarFileIndex = managedAidArgv?.indexOf('--file') ?? -1;
+        const avatarUrlIndex = managedAidArgv?.indexOf('--url') ?? -1;
+        const avatarSourceIndex = avatarFileIndex >= 0 ? avatarFileIndex : avatarUrlIndex;
+        const isSelfAvatarUpload = !!managedAidArgv
+            && (avatarSourceIndex === 4)
+            && managedAidArgv.length === 6
+            && managedAidArgv[0] === 'ec'
+            && managedAidArgv[1] === 'aid'
+            && managedAidArgv[2] === 'avatar'
+            && !!context.selfAid
+            && managedAidArgv[3]?.replace(/^@/, '') === context.selfAid.replace(/^@/, '')
+            && !!managedAidArgv[5]
+            && !managedAidArgv[5].startsWith('-');
         const canPublishSelfAgentMd = isSelfAgentMdPublish
             && ['request', 'bypass'].includes(context.permissionMode ?? '');
-        const isAllowedManagedAidCommand = isManagedAidPublicRead || isSelfManagedAidShow || canPublishSelfAgentMd;
+        const canUploadSelfAvatar = isSelfAvatarUpload
+            && ['request', 'bypass'].includes(context.permissionMode ?? '');
+        const isAllowedManagedAidCommand = isManagedAidPublicRead || isSelfManagedAidShow || canPublishSelfAgentMd || canUploadSelfAvatar;
         if (context.sessionId && /^\s*ec\s+aid(?:\s|$)/i.test(policyCommand) && !isAllowedManagedAidCommand) {
             return {
                 behavior: 'deny',
                 input,
                 message: isSelfAgentMdPublish && (context.permissionMode === 'readonly' || context.permissionMode === 'auto')
                     ? `🔒 ${context.permissionMode} 模式禁止发布 agent.md；请切换到 request 或 bypass 后再执行 \`ec aid agentmd put <当前 self AID>\`。`
-                    : '🔒 EvolCore 托管会话允许 `ec aid show <当前 self AID>`、`ec aid lookup <任意合法 AID>` 或 `ec aid agentmd get <任意合法 AID>`；`ec aid agentmd put` 还要求针对当前 self AID 且处于 request 或 bypass。可选后缀仅限 `--format json`。禁止列举本地身份、切换身份或对其它 AID 执行 show/put。',
+                    : isSelfAvatarUpload && (context.permissionMode === 'readonly' || context.permissionMode === 'auto')
+                        ? `🔒 ${context.permissionMode} 模式禁止上传头像；请切换到 request 或 bypass 后再执行 \`ec aid avatar <当前 self AID> (--file <path> 或 --url <https-url>)\`。`
+                        : '🔒 EvolCore 托管会话允许 `ec aid show <当前 self AID>`、`ec aid lookup <任意合法 AID>` 或 `ec aid agentmd get <任意合法 AID>`；`ec aid agentmd put` 及 `ec aid avatar` 还要求针对当前 self AID 且处于 request 或 bypass。可选后缀仅限 `--format json`。禁止列举本地身份、切换身份或对其它 AID 执行 show/put/avatar。',
                 policyCode: 'managed_ec_aid_scope_forbidden',
             };
         }
@@ -2281,7 +2321,7 @@ export function evaluateToolPreflight(toolName, input, context) {
             }
             if (ecCommand.issue === 'unsafe-expansion') {
                 const message = shellDialect === 'powershell'
-                    ? '🔒 EC 双引号正文包含未转义的 PowerShell 展开；纯文字请优先使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。PowerShell 传给 ec 时会还原为原文字面量'
+                    ? '🔒 EC 命令包含无法安全解析的 PowerShell 展开；临时路径仅支持已登记的当前会话 $env:TMPDIR 或 ${env:TMPDIR}，也可使用完整路径。纯文字请使用单引号，或用 PowerShell 反引号转义 $ 和正文内的双引号。'
                     : shellDialect === 'cmd'
                         ? '🔒 EC 命令包含未转义的 cmd.exe 展开；请不要使用 %VAR%、!VAR! 或 ^ 转义。cmd.exe 传给 ec 时必须保持原文字面量'
                         : '🔒 EC 双引号正文包含未转义的 Shell 展开；请将反引号写成 \\`，将 $()、${}、$变量中的 $ 写成 \\$。Shell 传给 ec 时会还原为原文字面量';