evolcore 0.0.25 → 0.0.27

package/dist/core/permission/ec-command-parser.js

@@ -16,6 +16,13 @@ const CODEX_CUSTOM_POWERSHELL_NAMES = new Set(['pwsh.exe', 'powershell.exe']);
 const CODEX_CUSTOM_CMD_NAMES = new Set(['cmd.exe']);
 const CODEX_CMD_EXECUTABLES = new Set(['cmd', 'cmd.exe']);
 const CODEX_CMD_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Windows[\\/](?:System32|SysWOW64|Sysnative)[\\/]cmd\.exe)$/i;
+// These switches only suppress interactive/profile UI behavior. `-Command`
+// is handled separately as the required execute switch. Options such as
+// `-NoExit`, `-ExecutionPolicy`, `-EncodedCommand`, and `-File` can change
+// execution semantics and must never be accepted as a trusted carrier.
+const CODEX_POWERSHELL_INERT_SWITCHES = new Set([
+    '-noprofile', '-noninteractive', '-nologo',
+]);
 // These switches affect only cmd startup/output formatting. `/c` is handled
 // separately as the required execute switch. Flags such as `/k`, `/v:on`,
 // `/e:*`, and `/f:*` can change process lifetime or command semantics and are
@@ -183,6 +190,10 @@ function substituteManagedTmpDirToken(value) {
     }
     return result;
 }
+function containsManagedTmpDirReference(value) {
+    return /\$TMPDIR|\$\{TMPDIR\}/.test(value)
+        || /\$env:TMPDIR|\$\{env:TMPDIR\}/i.test(value);
+}
 function restoreManagedTmpDirToken(value, managedTempDir) {
     return value.replaceAll(MANAGED_TMPDIR_TOKEN, managedTempDir ?? '$TMPDIR');
 }
@@ -218,24 +229,27 @@ export function normalizeEvolcoreCommandArgv(argv) {
     }
     return [...argv];
 }
-/** Detect the historical PowerShell pattern that overwrote the thread carrier. */
-export function hasPowerShellDelegationAssignment(command) {
-    return /^\s*\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(command)
+const POWERSHELL_CREDENTIAL_ENV_RE = /^(EVOLCORE_CODEX_SESSION_TOKEN|EVOLCORE_DELEGATION_TOKEN)$/i;
+/** Detect a PowerShell prefix that materializes an EvolCore session credential. */
+export function hasPowerShellCredentialAssignment(command) {
+    return /^\s*\$env\s*:\s*(?:EVOLCORE_CODEX_SESSION_TOKEN|EVOLCORE_DELEGATION_TOKEN)\b/i.test(command)
         && /\bec(?:\.cmd|\.exe)?(?:\s|$)/i.test(command);
 }
 /**
  * Windows Codex may materialize one environment variable assignment directly
  * in the PowerShell command body instead of inheriting it from the process
- * environment. Only the EvolCore delegation variable is accepted, and only
- * when followed by one command on the same carrier. The value is validated for
- * shape but never trusted for authorization; the runner still arms the stable
- * in-memory thread carrier.
+ * environment. Only an EvolCore session credential variable is accepted,
+ * and only when followed by one command in the same shell invocation. The
+ * legacy delegation name remains readable for rolling upgrades, but its value
+ * is still compared with the credential bound to the managed session.
  */
-function unwrapPowerShellDelegationPrefix(command) {
+function unwrapPowerShellCredentialPrefix(command) {
     const input = command.trim();
-    if (!/^\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(input)) {
+    const prefix = input.match(/^\$env\s*:\s*([A-Za-z_][A-Za-z0-9_]*)\b/i);
+    if (!prefix || !POWERSHELL_CREDENTIAL_ENV_RE.test(prefix[1])) {
         return { kind: 'none', command };
     }
+    const credentialEnvName = prefix[1];
     let index = 0;
     const skipSpace = () => {
         while (index < input.length && (input[index] === ' ' || input[index] === '\t'))
@@ -252,7 +266,7 @@ function unwrapPowerShellDelegationPrefix(command) {
         return { kind: 'invalid', command };
     index++;
     skipSpace();
-    if (!consume('EVOLCORE_DELEGATION_TOKEN'))
+    if (!consume(credentialEnvName))
         return { kind: 'invalid', command };
     skipSpace();
     if (input[index] !== '=')
@@ -324,20 +338,20 @@ export function parseCodexCarrierCommand(carrier, options = {}) {
         }
     }
     const unwrapped = carrier.dialect === 'powershell'
-        ? unwrapPowerShellDelegationPrefix(carrier.command)
+        ? unwrapPowerShellCredentialPrefix(carrier.command)
         : { kind: 'none', command: carrier.command };
     // Windows PowerShell may materialize the thread's shell environment as a
-    // single `$env:EVOLCORE_DELEGATION_TOKEN = '...'` prefix. Keep the token as
+    // single `$env:EVOLCORE_CODEX_SESSION_TOKEN = '...'` prefix. Keep the token as
     // metadata for the approval layer, which must compare it with the runner's
-    // in-memory carrier before arming delegation. Malformed or unrelated
+    // session credential before arming delegation. Malformed or unrelated
     // assignments remain syntax failures and can never be authorized.
     if (unwrapped.kind === 'invalid'
         || (carrier.dialect === 'powershell'
-            && hasPowerShellDelegationAssignment(carrier.command)
+            && hasPowerShellCredentialAssignment(carrier.command)
             && unwrapped.kind === 'none')
         || (unwrapped.kind === 'valid'
-            && options.expectedDelegationToken !== undefined
-            && options.expectedDelegationToken !== unwrapped.token)) {
+            && options.expectedCredentialToken !== undefined
+            && options.expectedCredentialToken !== unwrapped.token)) {
         return parseFailure('shell-composition', carrier.command, 0, 0, carrier.dialect);
     }
     const parsed = parseLiteralShellCommand(unwrapped.command, {
@@ -348,7 +362,7 @@ export function parseCodexCarrierCommand(carrier, options = {}) {
         ? {
             ...parsed,
             argv: normalizeEvolcoreCommandArgv(parsed.argv),
-            ...(unwrapped.kind === 'valid' ? { delegationToken: unwrapped.token } : {}),
+            ...(unwrapped.kind === 'valid' ? { credentialToken: unwrapped.token } : {}),
         }
         : parsed;
 }
@@ -362,7 +376,7 @@ function parseFailure(issue, input, offset, tokenIndex, dialect) {
         inputLength: input.length,
     };
 }
-function parseLiteralPowerShellCommand(command) {
+function parseLiteralPowerShellCommand(command, options = {}) {
     const input = trimShellSpacing(command);
     if (!input)
         return parseFailure('empty-command', input, 0, 0, 'powershell');
@@ -372,6 +386,9 @@ function parseLiteralPowerShellCommand(command) {
     let token = '';
     let tokenStarted = false;
     let quote = null;
+    // Environment variable names are case-insensitive on Windows. Require a
+    // complete variable name, including PowerShell's Unicode/name characters.
+    const managedTmpDirReference = new RegExp('^\\$(?:env:TMPDIR(?![\\p{L}\\p{Nd}_?:])|\\{env:TMPDIR\\})', process.platform === 'win32' ? 'iu' : 'u');
     const finishToken = () => {
         if (!tokenStarted)
             return;
@@ -396,6 +413,23 @@ function parseLiteralPowerShellCommand(command) {
             }
             continue;
         }
+        if (char === '$' && isShellParameterExpansionStart(input[index + 1])) {
+            const reference = managedTmpDirReference.exec(input.slice(index))?.[0];
+            const next = reference ? input[index + reference.length] : undefined;
+            if (!reference) {
+                return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
+            }
+            if (!options.allowManagedTmpDir || !options.managedTempDir
+                || (next !== undefined && !/[\\/\s"']/u.test(next))) {
+                return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
+            }
+            // Append the registered value directly: spaces remain in this argument,
+            // and characters in the directory are never interpreted as shell syntax.
+            token += options.managedTempDir;
+            tokenStarted = true;
+            index += reference.length - 1;
+            continue;
+        }
         if (quote === 'double') {
             if (char === '"') {
                 if (!isLiteralArgBoundary(input[index + 1]))
@@ -412,9 +446,6 @@ function parseLiteralPowerShellCommand(command) {
                 token += next;
                 continue;
             }
-            if (char === '$' && isShellParameterExpansionStart(input[index + 1])) {
-                return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
-            }
             token += char;
             continue;
         }
@@ -578,6 +609,25 @@ function resolveCodexCmdCarrierArgv(argv) {
         ? { command, dialect: 'cmd', executable: argv[0] }
         : undefined;
 }
+function resolveCodexPowerShellCarrierArgv(argv) {
+    if (argv.length < 3 || !isCodexPowerShellExecutable(argv[0]))
+        return undefined;
+    const commandIndex = argv.length - 2;
+    if (argv[commandIndex].toLowerCase() !== '-command')
+        return undefined;
+    const seen = new Set();
+    for (const rawSwitch of argv.slice(1, commandIndex)) {
+        const switchValue = rawSwitch.toLowerCase();
+        if (!CODEX_POWERSHELL_INERT_SWITCHES.has(switchValue) || seen.has(switchValue)) {
+            return undefined;
+        }
+        seen.add(switchValue);
+    }
+    const command = argv.at(-1);
+    return typeof command === 'string' && command.trim()
+        ? { command, dialect: 'powershell', executable: argv[0] }
+        : undefined;
+}
 /** Resolve a Windows cmd carrier when the app-server provides only a string. */
 function resolveCodexCmdCarrierString(command) {
     const input = trimShellSpacing(command);
@@ -593,10 +643,14 @@ function resolveCodexCmdCarrierString(command) {
     const argv = [executable, ...switches, match[4]];
     return resolveCodexCmdCarrierArgv(argv);
 }
-/** Resolve a PowerShell carrier when the app-server provides only a string. */
+/**
+ * Resolve a PowerShell carrier when the app-server provides only a string.
+ * The prefix is converted to the same argv shape used by commandArgv so the
+ * startup-switch policy cannot diverge between the two transport forms.
+ */
 function resolveCodexPowerShellCarrierString(command) {
     const input = trimShellSpacing(command);
-    const match = input.match(/^(?:"([^"]+)"|(\S+))\s+-command\s+(.+)$/i);
+    const match = input.match(/^(?:"([^"\r\n]+)"|(\S+))((?:[ \t]+-[A-Za-z]+)+)[ \t]+(.+)$/);
     if (!match)
         return undefined;
     const executable = match[1] ?? match[2];
@@ -605,13 +659,14 @@ function resolveCodexPowerShellCarrierString(command) {
     // A string-form carrier has one additional command-line quoting layer. The
     // command argument is commonly serialized as `"ec ..."`; remove exactly
     // that outer pair and leave quotes belonging to EC arguments intact.
-    let nested = match[3].trim();
+    let nested = match[4].trim();
     if (nested.length >= 2
         && ((nested.startsWith('"') && nested.endsWith('"'))
             || (nested.startsWith("'") && nested.endsWith("'")))) {
         nested = nested.slice(1, -1);
     }
-    return nested ? { command: nested, dialect: 'powershell', executable } : undefined;
+    const switches = match[3].trim().split(/[ \t]+/);
+    return resolveCodexPowerShellCarrierArgv([executable, ...switches, nested]);
 }
 /** Resolve a POSIX shell carrier when app-server provides only a string. */
 function resolveCodexPosixShellCarrierString(command) {
@@ -729,7 +784,7 @@ function doubleQuotedIssueAt(input, index) {
  */
 export function parseLiteralShellCommand(command, options = {}) {
     if (options.dialect === 'powershell') {
-        return parseLiteralPowerShellCommand(command);
+        return parseLiteralPowerShellCommand(command, options);
     }
     if (options.dialect === 'cmd') {
         return parseLiteralCmdCommand(command, options);
@@ -847,11 +902,9 @@ export function resolveCodexShellCarrierArgv(argv) {
         && isCodexPosixShellExecutable(argv[0])) {
         return { command: argv[2], dialect: 'posix', executable: argv[0] };
     }
-    if (argv.length === 3) {
-        if (isCodexPowerShellExecutable(argv[0]) && argv[1].toLowerCase() === '-command') {
-            return { command: argv[2], dialect: 'powershell', executable: argv[0] };
-        }
-    }
+    const powershellCarrier = resolveCodexPowerShellCarrierArgv(argv);
+    if (powershellCarrier)
+        return powershellCarrier;
     // Node/cross-spawn and Codex use cmd.exe with a small set of startup flags.
     // The execute switch must be the final switch before one command argument;
     // validation itself is shared with string-only Windows payloads below.
@@ -1416,16 +1469,16 @@ export function parseCodexExecToolCommand(input) {
     }
     return decoded;
 }
-function parseProactiveToolCommandArgv(toolName, input) {
+function parseProactiveToolCommand(toolName, input) {
     const options = {
         verifyShellExecutable: process.platform === 'win32',
     };
     if (toolName === 'Bash' || toolName === 'Shell')
-        return parseCodexToolCommandArgv(input, options);
+        return parseCodexToolCommand(input, options);
     if (toolName !== 'exec')
         return null;
     const command = parseCodexExecToolCommand(input);
-    return command ? parseCodexShellCommandArgv(command, { allowManagedTmpDir: true, ...options }) : null;
+    return command ? parseCodexToolCommand({ command }, options) : null;
 }
 function scanBoundedOutputOperators(command) {
     const operators = [];
@@ -1624,7 +1677,7 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
             if (!nested.ok && (hasCarrierEcCommandPrefix(carrier.command, carrier.dialect)
-                || (carrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(carrier.command)))) {
+                || (carrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(carrier.command)))) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
@@ -1634,7 +1687,7 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
             if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
-                || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
+                || (stringCarrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(stringCarrier.command)))) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
@@ -1656,7 +1709,7 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
         if (nested.ok && nested.argv[0] === 'ec')
             return { kind: 'literal' };
         if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
-            || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
+            || (stringCarrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(stringCarrier.command)))) {
             return { kind: 'composite', issue: nested.issue };
         }
         return { kind: 'none' };
@@ -1711,13 +1764,13 @@ function findSingleFileOption(argv, startIndex) {
 const PROACTIVE_SEND_VALUE_FLAGS = new Set([
     '--format', '--app', '--file', '--text-from-file', '--link', '--payload',
     '--title', '--description', '--text', '--transcript', '--as',
-    '--content-type', '--mention', '--aun-path', '--thread', '--return',
+    '--content-type', '--mention', '--aun-path', '--thread', '--return', '--handoff-context',
 ]);
 const PROACTIVE_SEND_BOOLEAN_FLAGS = new Set([
     '--encrypt', '--no-encrypt', '--mention-all',
 ]);
 const SEND_CONTENT_VALUE_FLAGS = new Set([
-    '--payload', '--title', '--description', '--text', '--transcript',
+    '--payload', '--title', '--description', '--text', '--transcript', '--handoff-context',
 ]);
 const TRIGGER_CONTENT_VALUE_FLAGS = new Set(['--prompt']);
 /**
@@ -1728,7 +1781,7 @@ const TRIGGER_CONTENT_VALUE_FLAGS = new Set(['--prompt']);
  */
 export function containsLiteralManagedTmpDirOutsideSendContent(argv) {
     const literalIndexes = argv
-        .map((value, index) => value.includes('$TMPDIR') ? index : -1)
+        .map((value, index) => containsManagedTmpDirReference(value) ? index : -1)
         .filter(index => index >= 0);
     if (literalIndexes.length === 0)
         return false;
@@ -1903,7 +1956,8 @@ export function isExactEvolcoreSendCommandForSession(toolName, input, channelId,
     // is represented as `exec` and is handled only for one literal inner call.
     if (!selfAid)
         return false;
-    const argv = parseProactiveToolCommandArgv(toolName, input);
+    const result = parseProactiveToolCommand(toolName, input);
+    const argv = result?.ok ? result.argv : null;
     const parsed = argv ? parseEvolcoreSendArgv(argv) : null;
     if (!parsed || parsed.action !== 'send')
         return false;
@@ -1914,3 +1968,20 @@ export function isExactEvolcoreSendCommandForSession(toolName, input, channelId,
         && !!argv
         && hasExecutableProactiveSendPayload(argv, expectedScope);
 }
+/** Diagnostic only: this never broadens the exact-send authorization check. */
+export function describeProactiveSendCommandFailure(toolName, input) {
+    if (!['Bash', 'Shell', 'exec'].includes(toolName) || !input || typeof input !== 'object')
+        return undefined;
+    const commandText = [input.command, input.input, ...(Array.isArray(input.commandArgv) ? input.commandArgv : [])]
+        .filter((value) => typeof value === 'string').join(' ');
+    if (!/\bec(?:\.cmd|\.exe)?\s+(?:group|msg)\s+send\b/i.test(commandText))
+        return undefined;
+    const result = parseProactiveToolCommand(toolName, input);
+    if (!result)
+        return '当前汇报命令未通过规范解析：只支持单次、字面量的发送调用，请将发送作为独立工具调用。';
+    if (!result.ok) {
+        return `当前汇报命令未通过规范解析（${result.issue}，${result.dialect}，位置 ${result.offset}）；`
+            + '请检查引号和转义，并将发送作为一条独立命令。';
+    }
+    return '当前汇报命令不符合当前会话的发送要求；请核对发送者、私聊或群目标，以及正文和参数。';
+}

package/dist/core/permission/protected-paths.js

@@ -28,9 +28,13 @@ const H_CLASS_RELATIVE_PATTERNS = [
     /^data\/outbox(?:\/|$)/,
     /^data\/handoff(?:\/|$)/,
     /^agents\/[^/]+\/sessions(?:\/|$)/,
+    /^agents\/[^/]+\/data\/async-questions(?:\/|$)/,
+    /^agents\/[^/]+\/data\/aun(?:\/|$)/,
     /^agents\/[^/]+\/data\/(?:channels(?:\/|$)|handoff(?:\/|$)|(?:outbox|activity-outbox)\.jsonl(?:_|__|\.tmp-.*)?$|contact-audit\.jsonl$)/,
 ];
 const H_CLASS_REFERENCE_PATTERNS = [
+    /(?:^|[/\\\s"'=<>])agents[\\/][^/\\\s"']+[\\/]data[\\/]async-questions(?:[\\/]|$|[\s"';&|<>)},])/,
+    /(?:^|[/\\\s"'=<>])agents[\\/][^/\\\s"']+[\\/]data[\\/]aun(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[^A-Za-z0-9_.-])daemon\.json(?=$|[^A-Za-z0-9_.-])/,
     /(?:^|[^A-Za-z0-9_.-])agents[\\/](?:defaults\.json|[^/\\\s"']+[\\/](?:(?:config|contact)\.json|contact-operations\.jsonl|relations[\\/][^/\\\s"']+[\\/]config\.json))(?=$|[\s"';&|<>)},])/,
     /(?:^|[^A-Za-z0-9_.-])(?:backups[\\/]config|\.snapshots|CA|(?:AIDs|aids)[\\/][^/\\\s"']+[\\/](?:cert|keys|private))(?:[\\/]|$|[\s"';&|<>)},])/,
@@ -43,6 +47,8 @@ const H_CLASS_REFERENCE_PATTERNS = [
 // protected file. Descendants inherit the directory classification unless an
 // existing regular file gives us a more precise answer.
 const H_CLASS_DIRECTORY_RELATIVE_PATTERNS = [
+    /^agents\/[^/]+\/data\/aun(?:\/|$)/,
+    /^agents\/[^/]+\/data\/async-questions(?:\/|$)/,
     /^backups\/config(?:\/|$)/,
     /^\.snapshots(?:\/|$)/,
     /^CA(?:\/|$)/,
@@ -286,6 +292,8 @@ export function getHClassSandboxPatterns(root = resolveRoot()) {
         path.join('agents', '*', 'sessions', '**'),
         path.join('agents', '*', 'data', 'channels', '**'),
         path.join('agents', '*', 'data', 'handoff', '**'),
+        path.join('agents', '*', 'data', 'async-questions', '**'),
+        path.join('agents', '*', 'data', 'aun', '**'),
         path.join('agents', '*', 'data', 'outbox.jsonl*'),
         path.join('agents', '*', 'data', 'activity-outbox.jsonl*'),
         path.join('agents', '*', 'data', 'contact-audit.jsonl'),
@@ -303,6 +311,15 @@ export function getLClassWritePatterns(root = resolveRoot()) {
 const CLAUDE_PROTECTED_TARGET_LIMIT = 8192;
 const CLAUDE_GLOB_MAGIC = /[*?[\]]/;
 const CODEX_GLOB_MAGIC = /[*?[\]]/;
+// Codex wraps the resolved Windows ACL payload in JSON and base64 before
+// passing it as one CreateProcess argument.  Real Codex 0.154 payloads are
+// roughly 3-5x larger than EvolCore's input map, so leave enough room below
+// Windows' 32,767-character command-line ceiling for helper metadata.
+const CODEX_WINDOWS_FILESYSTEM_RULE_BUDGET_BYTES = 7 * 1024;
+const CODEX_WINDOWS_MATERIALIZED_FILE_GLOBS = [
+    '**/*.json_',
+    '**/*.json.migrated',
+];
 function addExistingTarget(targets, value) {
     try {
         const stat = fs.lstatSync(value);
@@ -370,6 +387,8 @@ export function getExistingHClassMaskTargets(root = resolveRoot()) {
             addExistingTarget(targets, path.join(agentRoot, 'sessions'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'channels'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'handoff'));
+            addExistingTarget(targets, path.join(agentRoot, 'data', 'async-questions'));
+            addExistingTarget(targets, path.join(agentRoot, 'data', 'aun'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'outbox.jsonl'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'activity-outbox.jsonl'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'contact-audit.jsonl'));
@@ -427,14 +446,14 @@ export function buildClaudeProtectedFilesystem(root = resolveRoot(), options = {
         denyWrite: allPaths,
     };
 }
-export function buildCodexHClassFilesystemRules(root = resolveRoot()) {
+export function buildCodexHClassFilesystemRules(root = resolveRoot(), platform = process.platform) {
     const filesystem = {
         // Codex pre-expands unbounded deny globs on Linux/WSL/Windows. Without a
         // bound, patterns such as **/*.json_ are accepted but may not be enforced.
         glob_scan_max_depth: 64,
-        ...Object.fromEntries(filterWindowsCodexFilesystemTargets(getHClassSandboxPatterns(root)).map(pattern => [pattern, 'deny'])),
+        ...Object.fromEntries(filterWindowsCodexFilesystemTargets(getHClassSandboxPatterns(root), platform).map(pattern => [pattern, 'deny'])),
     };
-    return compactWindowsCodexFilesystemRules(filesystem);
+    return materializeWindowsCodexRecursiveFileDenies(compactWindowsCodexFilesystemRules(filesystem, platform), root, platform);
 }
 /**
  * Windows Codex sandbox setup materializes a path while applying its deny-read
@@ -462,20 +481,21 @@ export function filterWindowsCodexFilesystemTargets(patterns, platform = process
     });
 }
 /**
- * Codex expands recursive deny globs into individual targets. Large protected
+ * Codex expands recursive ACL globs into individual targets. Large protected
  * trees on Windows can then fail during AGENTS.md loading with os error 206.
- * Directory denies inherit to descendants through the Windows sandbox ACLs,
- * avoiding redundant targets. Keep broad recursive filename globs intact.
+ * Directory deny/read ACLs inherit to descendants, avoiding redundant targets.
+ * Keep broad recursive filename globs intact for the materialization pass.
  */
 export function compactWindowsCodexFilesystemRules(filesystem, platform = process.platform) {
     if (platform !== 'win32')
         return filesystem;
     const compacted = {};
+    const projectedKeys = new Map();
     for (const [pattern, access] of Object.entries(filesystem)) {
-        const isTerminalRecursiveDeny = access === 'deny'
+        const isTerminalRecursiveAcl = (access === 'deny' || access === 'read')
             && (pattern.endsWith('/**') || pattern.endsWith('\\**'));
-        const recursiveRoot = isTerminalRecursiveDeny ? pattern.slice(0, -3) : undefined;
-        // Only collapse a recursive deny when its root is a real directory.  A
+        const recursiveRoot = isTerminalRecursiveAcl ? pattern.slice(0, -3) : undefined;
+        // Only collapse a recursive ACL when its root is a real directory.  A
         // missing root must remain a glob: turning it into an exact target can
         // make the Windows sandbox materialize that path as a directory.
         const canCompact = !!recursiveRoot
@@ -488,12 +508,104 @@ export function compactWindowsCodexFilesystemRules(filesystem, platform = proces
                 }
             })());
         const compactPattern = canCompact ? recursiveRoot : pattern;
-        if (compacted[compactPattern] !== 'deny')
-            compacted[compactPattern] = access;
+        let projectedPattern = compactPattern;
+        {
+            // Resolve only the literal prefix and only casing aliases. Do not fold
+            // glob spelling, unresolved paths, case-sensitive directories or links.
+            const globIndex = compactPattern.search(CODEX_GLOB_MAGIC);
+            const prefix = globIndex < 0 ? compactPattern : compactPattern.slice(0, Math.max(compactPattern.lastIndexOf('/', globIndex), compactPattern.lastIndexOf('\\', globIndex)));
+            let key = compactPattern;
+            try {
+                const canonical = fs.realpathSync.native(prefix);
+                if (canonical.toLowerCase() === prefix.toLowerCase())
+                    key = canonical + compactPattern.slice(prefix.length);
+            }
+            catch { /* An unresolved alias must retain its deny rule. */ }
+            projectedPattern = projectedKeys.get(key) ?? compactPattern;
+            projectedKeys.set(key, projectedPattern);
+        }
+        if (compacted[projectedPattern] !== 'deny')
+            compacted[projectedPattern] = access;
+    }
+    // Directory deny ACLs inherit. After H/L rules are combined, omit exact
+    // file denies already covered by an existing directory deny. Keep globs
+    // and any child for which a read/write override could change precedence.
+    const entries = Object.entries(compacted);
+    const denyDirectories = entries.filter(([pattern, access]) => {
+        if (access !== 'deny' || CODEX_GLOB_MAGIC.test(pattern))
+            return false;
+        try {
+            return fs.lstatSync(pattern).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    }).map(([pattern]) => pattern);
+    for (const [pattern, access] of entries) {
+        if (access !== 'deny' || CODEX_GLOB_MAGIC.test(pattern) || denyDirectories.includes(pattern))
+            continue;
+        if (denyDirectories.some(parent => isSameOrDescendant(pattern, parent)
+            && !entries.some(([override, value]) => (value === 'read' || value === 'write')
+                && (CODEX_GLOB_MAGIC.test(override) || isSameOrDescendant(override, parent))))) {
+            delete compacted[pattern];
+        }
     }
     return compacted;
 }
+/**
+ * Codex 0.154 serializes resolved Windows deny-read targets into a base64
+ * command-line argument for codex-windows-sandbox-setup.exe.  Recursive file
+ * globs can expand into enough absolute paths to exceed CreateProcess' command
+ * line limit.  Claude avoids the analogous limit by externalizing settings;
+ * Codex has no per-thread settings-file input, so materialize only these broad
+ * file globs in EvolCore and keep the compact exact projection in thread config.
+ *
+ * Matches below an already denied directory are omitted because the Windows
+ * sandbox ACL on that directory inherits to descendants.  Other H-class rules
+ * remain dynamic globs, preserving protection for newly created agent/config
+ * paths without recreating the unbounded recursive expansion.
+ */
+export function materializeWindowsCodexRecursiveFileDenies(filesystem, root = resolveRoot(), platform = process.platform) {
+    if (platform !== 'win32')
+        return filesystem;
+    const absoluteRoot = resolveThroughExistingAncestor(root);
+    const materializedPatterns = new Set(CODEX_WINDOWS_MATERIALIZED_FILE_GLOBS.map(pattern => path.join(absoluteRoot, pattern)));
+    const deniedDirectories = getExistingHClassMaskTargets(absoluteRoot)
+        .filter(target => target.kind === 'directory')
+        .map(target => target.path);
+    const projected = {};
+    for (const [pattern, access] of Object.entries(filesystem)) {
+        if (access !== 'deny' || !materializedPatterns.has(pattern)) {
+            projected[pattern] = access;
+            continue;
+        }
+        const relativePattern = path.relative(absoluteRoot, pattern).split(path.sep).join('/');
+        let matches;
+        try {
+            matches = fs.globSync(relativePattern, { cwd: absoluteRoot });
+        }
+        catch (error) {
+            throw new Error(`[CodexSandbox] failed to materialize Windows protected-file rules: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        for (const match of matches) {
+            const candidate = path.resolve(absoluteRoot, match);
+            if (deniedDirectories.some(directory => isSameOrDescendant(candidate, directory)))
+                continue;
+            projected[candidate] = access;
+        }
+    }
+    return projected;
+}
+export function assertWindowsCodexFilesystemRuleBudget(filesystem, platform = process.platform) {
+    if (platform !== 'win32')
+        return;
+    const bytes = Buffer.byteLength(JSON.stringify(filesystem), 'utf8');
+    if (bytes > CODEX_WINDOWS_FILESYSTEM_RULE_BUDGET_BYTES) {
+        throw new Error(`[CodexSandbox] Windows filesystem rule budget exceeded: ${bytes} > ${CODEX_WINDOWS_FILESYSTEM_RULE_BUDGET_BYTES}`);
+    }
+}
 export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options = {}) {
+    const platform = options.platform ?? process.platform;
     const lClassRules = {};
     const lClassAccess = options.denyLClassRead ? 'deny' : 'read';
     // Codex's Linux sandbox expands glob deny rules into per-file mount targets.
@@ -506,10 +618,14 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
     const expandLClassReadDeny = options.expandLClassReadDeny ?? true;
     for (const target of getExistingLClassReadOnlyTargets(root)) {
         if (target.kind === 'directory') {
-            if (!expandLClassReadDeny || options.denyLClassRead || path.basename(target.path) === 'triggers') {
+            // :workspace/:read-only already grants L-class read access on Windows.
+            // Omitting redundant read ACLs keeps Codex's serialized helper payload
+            // below CreateProcess' command-line limit. Readonly still needs deny.
+            const includeWindowsRead = platform !== 'win32' || options.denyLClassRead;
+            if (includeWindowsRead && (!expandLClassReadDeny || options.denyLClassRead || path.basename(target.path) === 'triggers')) {
                 lClassRules[target.path] = lClassAccess;
             }
-            if (expandLClassReadDeny || !options.denyLClassRead) {
+            if (includeWindowsRead && (expandLClassReadDeny || !options.denyLClassRead)) {
                 // Use '/**' suffix instead of path.join to satisfy Codex's glob requirement
                 lClassRules[target.path + '/**'] = lClassAccess;
             }
@@ -518,10 +634,12 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
             lClassRules[target.path] = lClassAccess;
         }
     }
-    return compactWindowsCodexFilesystemRules({
-        ...buildCodexHClassFilesystemRules(root),
+    const filesystem = compactWindowsCodexFilesystemRules({
+        ...buildCodexHClassFilesystemRules(root, platform),
         ...lClassRules,
-    });
+    }, platform);
+    assertWindowsCodexFilesystemRuleBudget(filesystem, platform);
+    return filesystem;
 }
 export function hClassGrantIncludesProtectedPath(value, options = {}) {
     const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());