evolcore 0.0.26 → 0.0.27

package/dist/core/permission/approval-gateway.js

@@ -178,6 +178,35 @@ function approvalCodeBlock(value) {
     const fence = '`'.repeat(Math.max(3, longestRun + 1));
     return `${fence}text\n${value}\n${fence}`;
 }
+function normalizeAidForApprovalRouting(value) {
+    const normalized = value?.trim().replace(/^@/, '');
+    return normalized || undefined;
+}
+function preferredOriginOwner(context, approval, owners) {
+    const originChannel = (approval?.originChannel ?? context.channel ?? '').split('#', 1)[0].toLowerCase();
+    if (context.chatType !== 'private' || originChannel !== 'aun')
+        return undefined;
+    const originPeerId = normalizeAidForApprovalRouting(approval?.originPeerId ?? context.userId);
+    if (!originPeerId)
+        return undefined;
+    return owners.find(owner => normalizeAidForApprovalRouting(owner) === originPeerId);
+}
+/**
+ * Owner approvals normally belong to the Owner's private main session. The
+ * one exception is an AUN private conversation whose peer is itself a
+ * configured Owner: preserve that conversation's topic so the request stays
+ * with the Owner's current work.
+ */
+function ownerApprovalThreadId(context, approval, approverOperatorId) {
+    const originChannel = (approval.originChannel ?? context.channel ?? '').split('#', 1)[0].toLowerCase();
+    const originPeerId = normalizeAidForApprovalRouting(approval.originPeerId ?? context.userId);
+    const approverId = normalizeAidForApprovalRouting(approverOperatorId);
+    const isOwnerPrivateConversation = context.chatType === 'private'
+        && originChannel === 'aun'
+        && !!originPeerId
+        && originPeerId === approverId;
+    return isOwnerPrivateConversation ? (approval.originThreadId ?? '') : '';
+}
 export function planApprovalRoute(challenge, context) {
     if (!challenge.grantable) {
         return { kind: 'unavailable', reason: 'challenge_not_grantable' };
@@ -235,9 +264,12 @@ export function planApprovalRoute(challenge, context) {
             approverPrincipalId: actor.principalId,
         };
     }
-    const handoffCandidates = challenge.approverPolicy === 'agent_manager'
-        ? Array.from(new Set([...admins, ...owners]))
-        : owners;
+    const preferredOwner = preferredOriginOwner(context ?? {}, routing, owners);
+    const handoffCandidates = preferredOwner
+        ? [preferredOwner]
+        : challenge.approverPolicy === 'agent_manager'
+            ? Array.from(new Set([...admins, ...owners]))
+            : owners;
     if (handoffCandidates.length === 0) {
         return {
             kind: 'unavailable',
@@ -777,6 +809,7 @@ export class PermissionGateway {
         }
         const ownerReplyContext = {
             delivery: { chatType: 'private' },
+            threadId: ownerApprovalThreadId(context, approval, route.approverOperatorId),
             metadata: {
                 source: 'handoff',
                 chatmode: 'interactive',

package/dist/core/permission/ec-command-parser.js

@@ -16,6 +16,13 @@ const CODEX_CUSTOM_POWERSHELL_NAMES = new Set(['pwsh.exe', 'powershell.exe']);
 const CODEX_CUSTOM_CMD_NAMES = new Set(['cmd.exe']);
 const CODEX_CMD_EXECUTABLES = new Set(['cmd', 'cmd.exe']);
 const CODEX_CMD_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Windows[\\/](?:System32|SysWOW64|Sysnative)[\\/]cmd\.exe)$/i;
+// These switches only suppress interactive/profile UI behavior. `-Command`
+// is handled separately as the required execute switch. Options such as
+// `-NoExit`, `-ExecutionPolicy`, `-EncodedCommand`, and `-File` can change
+// execution semantics and must never be accepted as a trusted carrier.
+const CODEX_POWERSHELL_INERT_SWITCHES = new Set([
+    '-noprofile', '-noninteractive', '-nologo',
+]);
 // These switches affect only cmd startup/output formatting. `/c` is handled
 // separately as the required execute switch. Flags such as `/k`, `/v:on`,
 // `/e:*`, and `/f:*` can change process lifetime or command semantics and are
@@ -222,24 +229,27 @@ export function normalizeEvolcoreCommandArgv(argv) {
     }
     return [...argv];
 }
-/** Detect the historical PowerShell pattern that overwrote the thread carrier. */
-export function hasPowerShellDelegationAssignment(command) {
-    return /^\s*\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(command)
+const POWERSHELL_CREDENTIAL_ENV_RE = /^(EVOLCORE_CODEX_SESSION_TOKEN|EVOLCORE_DELEGATION_TOKEN)$/i;
+/** Detect a PowerShell prefix that materializes an EvolCore session credential. */
+export function hasPowerShellCredentialAssignment(command) {
+    return /^\s*\$env\s*:\s*(?:EVOLCORE_CODEX_SESSION_TOKEN|EVOLCORE_DELEGATION_TOKEN)\b/i.test(command)
         && /\bec(?:\.cmd|\.exe)?(?:\s|$)/i.test(command);
 }
 /**
  * Windows Codex may materialize one environment variable assignment directly
  * in the PowerShell command body instead of inheriting it from the process
- * environment. Only the EvolCore delegation variable is accepted, and only
- * when followed by one command on the same carrier. The value is validated for
- * shape but never trusted for authorization; the runner still arms the stable
- * in-memory thread carrier.
+ * environment. Only an EvolCore session credential variable is accepted,
+ * and only when followed by one command in the same shell invocation. The
+ * legacy delegation name remains readable for rolling upgrades, but its value
+ * is still compared with the credential bound to the managed session.
  */
-function unwrapPowerShellDelegationPrefix(command) {
+function unwrapPowerShellCredentialPrefix(command) {
     const input = command.trim();
-    if (!/^\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(input)) {
+    const prefix = input.match(/^\$env\s*:\s*([A-Za-z_][A-Za-z0-9_]*)\b/i);
+    if (!prefix || !POWERSHELL_CREDENTIAL_ENV_RE.test(prefix[1])) {
         return { kind: 'none', command };
     }
+    const credentialEnvName = prefix[1];
     let index = 0;
     const skipSpace = () => {
         while (index < input.length && (input[index] === ' ' || input[index] === '\t'))
@@ -256,7 +266,7 @@ function unwrapPowerShellDelegationPrefix(command) {
         return { kind: 'invalid', command };
     index++;
     skipSpace();
-    if (!consume('EVOLCORE_DELEGATION_TOKEN'))
+    if (!consume(credentialEnvName))
         return { kind: 'invalid', command };
     skipSpace();
     if (input[index] !== '=')
@@ -328,20 +338,20 @@ export function parseCodexCarrierCommand(carrier, options = {}) {
         }
     }
     const unwrapped = carrier.dialect === 'powershell'
-        ? unwrapPowerShellDelegationPrefix(carrier.command)
+        ? unwrapPowerShellCredentialPrefix(carrier.command)
         : { kind: 'none', command: carrier.command };
     // Windows PowerShell may materialize the thread's shell environment as a
-    // single `$env:EVOLCORE_DELEGATION_TOKEN = '...'` prefix. Keep the token as
+    // single `$env:EVOLCORE_CODEX_SESSION_TOKEN = '...'` prefix. Keep the token as
     // metadata for the approval layer, which must compare it with the runner's
-    // in-memory carrier before arming delegation. Malformed or unrelated
+    // session credential before arming delegation. Malformed or unrelated
     // assignments remain syntax failures and can never be authorized.
     if (unwrapped.kind === 'invalid'
         || (carrier.dialect === 'powershell'
-            && hasPowerShellDelegationAssignment(carrier.command)
+            && hasPowerShellCredentialAssignment(carrier.command)
             && unwrapped.kind === 'none')
         || (unwrapped.kind === 'valid'
-            && options.expectedDelegationToken !== undefined
-            && options.expectedDelegationToken !== unwrapped.token)) {
+            && options.expectedCredentialToken !== undefined
+            && options.expectedCredentialToken !== unwrapped.token)) {
         return parseFailure('shell-composition', carrier.command, 0, 0, carrier.dialect);
     }
     const parsed = parseLiteralShellCommand(unwrapped.command, {
@@ -352,7 +362,7 @@ export function parseCodexCarrierCommand(carrier, options = {}) {
         ? {
             ...parsed,
             argv: normalizeEvolcoreCommandArgv(parsed.argv),
-            ...(unwrapped.kind === 'valid' ? { delegationToken: unwrapped.token } : {}),
+            ...(unwrapped.kind === 'valid' ? { credentialToken: unwrapped.token } : {}),
         }
         : parsed;
 }
@@ -599,6 +609,25 @@ function resolveCodexCmdCarrierArgv(argv) {
         ? { command, dialect: 'cmd', executable: argv[0] }
         : undefined;
 }
+function resolveCodexPowerShellCarrierArgv(argv) {
+    if (argv.length < 3 || !isCodexPowerShellExecutable(argv[0]))
+        return undefined;
+    const commandIndex = argv.length - 2;
+    if (argv[commandIndex].toLowerCase() !== '-command')
+        return undefined;
+    const seen = new Set();
+    for (const rawSwitch of argv.slice(1, commandIndex)) {
+        const switchValue = rawSwitch.toLowerCase();
+        if (!CODEX_POWERSHELL_INERT_SWITCHES.has(switchValue) || seen.has(switchValue)) {
+            return undefined;
+        }
+        seen.add(switchValue);
+    }
+    const command = argv.at(-1);
+    return typeof command === 'string' && command.trim()
+        ? { command, dialect: 'powershell', executable: argv[0] }
+        : undefined;
+}
 /** Resolve a Windows cmd carrier when the app-server provides only a string. */
 function resolveCodexCmdCarrierString(command) {
     const input = trimShellSpacing(command);
@@ -614,10 +643,14 @@ function resolveCodexCmdCarrierString(command) {
     const argv = [executable, ...switches, match[4]];
     return resolveCodexCmdCarrierArgv(argv);
 }
-/** Resolve a PowerShell carrier when the app-server provides only a string. */
+/**
+ * Resolve a PowerShell carrier when the app-server provides only a string.
+ * The prefix is converted to the same argv shape used by commandArgv so the
+ * startup-switch policy cannot diverge between the two transport forms.
+ */
 function resolveCodexPowerShellCarrierString(command) {
     const input = trimShellSpacing(command);
-    const match = input.match(/^(?:"([^"]+)"|(\S+))\s+-command\s+(.+)$/i);
+    const match = input.match(/^(?:"([^"\r\n]+)"|(\S+))((?:[ \t]+-[A-Za-z]+)+)[ \t]+(.+)$/);
     if (!match)
         return undefined;
     const executable = match[1] ?? match[2];
@@ -626,13 +659,14 @@ function resolveCodexPowerShellCarrierString(command) {
     // A string-form carrier has one additional command-line quoting layer. The
     // command argument is commonly serialized as `"ec ..."`; remove exactly
     // that outer pair and leave quotes belonging to EC arguments intact.
-    let nested = match[3].trim();
+    let nested = match[4].trim();
     if (nested.length >= 2
         && ((nested.startsWith('"') && nested.endsWith('"'))
             || (nested.startsWith("'") && nested.endsWith("'")))) {
         nested = nested.slice(1, -1);
     }
-    return nested ? { command: nested, dialect: 'powershell', executable } : undefined;
+    const switches = match[3].trim().split(/[ \t]+/);
+    return resolveCodexPowerShellCarrierArgv([executable, ...switches, nested]);
 }
 /** Resolve a POSIX shell carrier when app-server provides only a string. */
 function resolveCodexPosixShellCarrierString(command) {
@@ -868,11 +902,9 @@ export function resolveCodexShellCarrierArgv(argv) {
         && isCodexPosixShellExecutable(argv[0])) {
         return { command: argv[2], dialect: 'posix', executable: argv[0] };
     }
-    if (argv.length === 3) {
-        if (isCodexPowerShellExecutable(argv[0]) && argv[1].toLowerCase() === '-command') {
-            return { command: argv[2], dialect: 'powershell', executable: argv[0] };
-        }
-    }
+    const powershellCarrier = resolveCodexPowerShellCarrierArgv(argv);
+    if (powershellCarrier)
+        return powershellCarrier;
     // Node/cross-spawn and Codex use cmd.exe with a small set of startup flags.
     // The execute switch must be the final switch before one command argument;
     // validation itself is shared with string-only Windows payloads below.
@@ -1645,7 +1677,7 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
             if (!nested.ok && (hasCarrierEcCommandPrefix(carrier.command, carrier.dialect)
-                || (carrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(carrier.command)))) {
+                || (carrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(carrier.command)))) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
@@ -1655,7 +1687,7 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
             if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
-                || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
+                || (stringCarrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(stringCarrier.command)))) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
@@ -1677,7 +1709,7 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
         if (nested.ok && nested.argv[0] === 'ec')
             return { kind: 'literal' };
         if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
-            || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
+            || (stringCarrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(stringCarrier.command)))) {
             return { kind: 'composite', issue: nested.issue };
         }
         return { kind: 'none' };

package/dist/core/permission/protected-paths.js

@@ -28,9 +28,13 @@ const H_CLASS_RELATIVE_PATTERNS = [
     /^data\/outbox(?:\/|$)/,
     /^data\/handoff(?:\/|$)/,
     /^agents\/[^/]+\/sessions(?:\/|$)/,
+    /^agents\/[^/]+\/data\/async-questions(?:\/|$)/,
+    /^agents\/[^/]+\/data\/aun(?:\/|$)/,
     /^agents\/[^/]+\/data\/(?:channels(?:\/|$)|handoff(?:\/|$)|(?:outbox|activity-outbox)\.jsonl(?:_|__|\.tmp-.*)?$|contact-audit\.jsonl$)/,
 ];
 const H_CLASS_REFERENCE_PATTERNS = [
+    /(?:^|[/\\\s"'=<>])agents[\\/][^/\\\s"']+[\\/]data[\\/]async-questions(?:[\\/]|$|[\s"';&|<>)},])/,
+    /(?:^|[/\\\s"'=<>])agents[\\/][^/\\\s"']+[\\/]data[\\/]aun(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[^A-Za-z0-9_.-])daemon\.json(?=$|[^A-Za-z0-9_.-])/,
     /(?:^|[^A-Za-z0-9_.-])agents[\\/](?:defaults\.json|[^/\\\s"']+[\\/](?:(?:config|contact)\.json|contact-operations\.jsonl|relations[\\/][^/\\\s"']+[\\/]config\.json))(?=$|[\s"';&|<>)},])/,
     /(?:^|[^A-Za-z0-9_.-])(?:backups[\\/]config|\.snapshots|CA|(?:AIDs|aids)[\\/][^/\\\s"']+[\\/](?:cert|keys|private))(?:[\\/]|$|[\s"';&|<>)},])/,
@@ -43,6 +47,8 @@ const H_CLASS_REFERENCE_PATTERNS = [
 // protected file. Descendants inherit the directory classification unless an
 // existing regular file gives us a more precise answer.
 const H_CLASS_DIRECTORY_RELATIVE_PATTERNS = [
+    /^agents\/[^/]+\/data\/aun(?:\/|$)/,
+    /^agents\/[^/]+\/data\/async-questions(?:\/|$)/,
     /^backups\/config(?:\/|$)/,
     /^\.snapshots(?:\/|$)/,
     /^CA(?:\/|$)/,
@@ -286,6 +292,8 @@ export function getHClassSandboxPatterns(root = resolveRoot()) {
         path.join('agents', '*', 'sessions', '**'),
         path.join('agents', '*', 'data', 'channels', '**'),
         path.join('agents', '*', 'data', 'handoff', '**'),
+        path.join('agents', '*', 'data', 'async-questions', '**'),
+        path.join('agents', '*', 'data', 'aun', '**'),
         path.join('agents', '*', 'data', 'outbox.jsonl*'),
         path.join('agents', '*', 'data', 'activity-outbox.jsonl*'),
         path.join('agents', '*', 'data', 'contact-audit.jsonl'),
@@ -303,6 +311,15 @@ export function getLClassWritePatterns(root = resolveRoot()) {
 const CLAUDE_PROTECTED_TARGET_LIMIT = 8192;
 const CLAUDE_GLOB_MAGIC = /[*?[\]]/;
 const CODEX_GLOB_MAGIC = /[*?[\]]/;
+// Codex wraps the resolved Windows ACL payload in JSON and base64 before
+// passing it as one CreateProcess argument.  Real Codex 0.154 payloads are
+// roughly 3-5x larger than EvolCore's input map, so leave enough room below
+// Windows' 32,767-character command-line ceiling for helper metadata.
+const CODEX_WINDOWS_FILESYSTEM_RULE_BUDGET_BYTES = 7 * 1024;
+const CODEX_WINDOWS_MATERIALIZED_FILE_GLOBS = [
+    '**/*.json_',
+    '**/*.json.migrated',
+];
 function addExistingTarget(targets, value) {
     try {
         const stat = fs.lstatSync(value);
@@ -370,6 +387,8 @@ export function getExistingHClassMaskTargets(root = resolveRoot()) {
             addExistingTarget(targets, path.join(agentRoot, 'sessions'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'channels'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'handoff'));
+            addExistingTarget(targets, path.join(agentRoot, 'data', 'async-questions'));
+            addExistingTarget(targets, path.join(agentRoot, 'data', 'aun'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'outbox.jsonl'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'activity-outbox.jsonl'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'contact-audit.jsonl'));
@@ -427,14 +446,14 @@ export function buildClaudeProtectedFilesystem(root = resolveRoot(), options = {
         denyWrite: allPaths,
     };
 }
-export function buildCodexHClassFilesystemRules(root = resolveRoot()) {
+export function buildCodexHClassFilesystemRules(root = resolveRoot(), platform = process.platform) {
     const filesystem = {
         // Codex pre-expands unbounded deny globs on Linux/WSL/Windows. Without a
         // bound, patterns such as **/*.json_ are accepted but may not be enforced.
         glob_scan_max_depth: 64,
-        ...Object.fromEntries(filterWindowsCodexFilesystemTargets(getHClassSandboxPatterns(root)).map(pattern => [pattern, 'deny'])),
+        ...Object.fromEntries(filterWindowsCodexFilesystemTargets(getHClassSandboxPatterns(root), platform).map(pattern => [pattern, 'deny'])),
     };
-    return compactWindowsCodexFilesystemRules(filesystem);
+    return materializeWindowsCodexRecursiveFileDenies(compactWindowsCodexFilesystemRules(filesystem, platform), root, platform);
 }
 /**
  * Windows Codex sandbox setup materializes a path while applying its deny-read
@@ -462,20 +481,21 @@ export function filterWindowsCodexFilesystemTargets(patterns, platform = process
     });
 }
 /**
- * Codex expands recursive deny globs into individual targets. Large protected
+ * Codex expands recursive ACL globs into individual targets. Large protected
  * trees on Windows can then fail during AGENTS.md loading with os error 206.
- * Directory denies inherit to descendants through the Windows sandbox ACLs,
- * avoiding redundant targets. Keep broad recursive filename globs intact.
+ * Directory deny/read ACLs inherit to descendants, avoiding redundant targets.
+ * Keep broad recursive filename globs intact for the materialization pass.
  */
 export function compactWindowsCodexFilesystemRules(filesystem, platform = process.platform) {
     if (platform !== 'win32')
         return filesystem;
     const compacted = {};
+    const projectedKeys = new Map();
     for (const [pattern, access] of Object.entries(filesystem)) {
-        const isTerminalRecursiveDeny = access === 'deny'
+        const isTerminalRecursiveAcl = (access === 'deny' || access === 'read')
             && (pattern.endsWith('/**') || pattern.endsWith('\\**'));
-        const recursiveRoot = isTerminalRecursiveDeny ? pattern.slice(0, -3) : undefined;
-        // Only collapse a recursive deny when its root is a real directory.  A
+        const recursiveRoot = isTerminalRecursiveAcl ? pattern.slice(0, -3) : undefined;
+        // Only collapse a recursive ACL when its root is a real directory.  A
         // missing root must remain a glob: turning it into an exact target can
         // make the Windows sandbox materialize that path as a directory.
         const canCompact = !!recursiveRoot
@@ -488,12 +508,104 @@ export function compactWindowsCodexFilesystemRules(filesystem, platform = proces
                 }
             })());
         const compactPattern = canCompact ? recursiveRoot : pattern;
-        if (compacted[compactPattern] !== 'deny')
-            compacted[compactPattern] = access;
+        let projectedPattern = compactPattern;
+        {
+            // Resolve only the literal prefix and only casing aliases. Do not fold
+            // glob spelling, unresolved paths, case-sensitive directories or links.
+            const globIndex = compactPattern.search(CODEX_GLOB_MAGIC);
+            const prefix = globIndex < 0 ? compactPattern : compactPattern.slice(0, Math.max(compactPattern.lastIndexOf('/', globIndex), compactPattern.lastIndexOf('\\', globIndex)));
+            let key = compactPattern;
+            try {
+                const canonical = fs.realpathSync.native(prefix);
+                if (canonical.toLowerCase() === prefix.toLowerCase())
+                    key = canonical + compactPattern.slice(prefix.length);
+            }
+            catch { /* An unresolved alias must retain its deny rule. */ }
+            projectedPattern = projectedKeys.get(key) ?? compactPattern;
+            projectedKeys.set(key, projectedPattern);
+        }
+        if (compacted[projectedPattern] !== 'deny')
+            compacted[projectedPattern] = access;
+    }
+    // Directory deny ACLs inherit. After H/L rules are combined, omit exact
+    // file denies already covered by an existing directory deny. Keep globs
+    // and any child for which a read/write override could change precedence.
+    const entries = Object.entries(compacted);
+    const denyDirectories = entries.filter(([pattern, access]) => {
+        if (access !== 'deny' || CODEX_GLOB_MAGIC.test(pattern))
+            return false;
+        try {
+            return fs.lstatSync(pattern).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    }).map(([pattern]) => pattern);
+    for (const [pattern, access] of entries) {
+        if (access !== 'deny' || CODEX_GLOB_MAGIC.test(pattern) || denyDirectories.includes(pattern))
+            continue;
+        if (denyDirectories.some(parent => isSameOrDescendant(pattern, parent)
+            && !entries.some(([override, value]) => (value === 'read' || value === 'write')
+                && (CODEX_GLOB_MAGIC.test(override) || isSameOrDescendant(override, parent))))) {
+            delete compacted[pattern];
+        }
     }
     return compacted;
 }
+/**
+ * Codex 0.154 serializes resolved Windows deny-read targets into a base64
+ * command-line argument for codex-windows-sandbox-setup.exe.  Recursive file
+ * globs can expand into enough absolute paths to exceed CreateProcess' command
+ * line limit.  Claude avoids the analogous limit by externalizing settings;
+ * Codex has no per-thread settings-file input, so materialize only these broad
+ * file globs in EvolCore and keep the compact exact projection in thread config.
+ *
+ * Matches below an already denied directory are omitted because the Windows
+ * sandbox ACL on that directory inherits to descendants.  Other H-class rules
+ * remain dynamic globs, preserving protection for newly created agent/config
+ * paths without recreating the unbounded recursive expansion.
+ */
+export function materializeWindowsCodexRecursiveFileDenies(filesystem, root = resolveRoot(), platform = process.platform) {
+    if (platform !== 'win32')
+        return filesystem;
+    const absoluteRoot = resolveThroughExistingAncestor(root);
+    const materializedPatterns = new Set(CODEX_WINDOWS_MATERIALIZED_FILE_GLOBS.map(pattern => path.join(absoluteRoot, pattern)));
+    const deniedDirectories = getExistingHClassMaskTargets(absoluteRoot)
+        .filter(target => target.kind === 'directory')
+        .map(target => target.path);
+    const projected = {};
+    for (const [pattern, access] of Object.entries(filesystem)) {
+        if (access !== 'deny' || !materializedPatterns.has(pattern)) {
+            projected[pattern] = access;
+            continue;
+        }
+        const relativePattern = path.relative(absoluteRoot, pattern).split(path.sep).join('/');
+        let matches;
+        try {
+            matches = fs.globSync(relativePattern, { cwd: absoluteRoot });
+        }
+        catch (error) {
+            throw new Error(`[CodexSandbox] failed to materialize Windows protected-file rules: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        for (const match of matches) {
+            const candidate = path.resolve(absoluteRoot, match);
+            if (deniedDirectories.some(directory => isSameOrDescendant(candidate, directory)))
+                continue;
+            projected[candidate] = access;
+        }
+    }
+    return projected;
+}
+export function assertWindowsCodexFilesystemRuleBudget(filesystem, platform = process.platform) {
+    if (platform !== 'win32')
+        return;
+    const bytes = Buffer.byteLength(JSON.stringify(filesystem), 'utf8');
+    if (bytes > CODEX_WINDOWS_FILESYSTEM_RULE_BUDGET_BYTES) {
+        throw new Error(`[CodexSandbox] Windows filesystem rule budget exceeded: ${bytes} > ${CODEX_WINDOWS_FILESYSTEM_RULE_BUDGET_BYTES}`);
+    }
+}
 export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options = {}) {
+    const platform = options.platform ?? process.platform;
     const lClassRules = {};
     const lClassAccess = options.denyLClassRead ? 'deny' : 'read';
     // Codex's Linux sandbox expands glob deny rules into per-file mount targets.
@@ -506,10 +618,14 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
     const expandLClassReadDeny = options.expandLClassReadDeny ?? true;
     for (const target of getExistingLClassReadOnlyTargets(root)) {
         if (target.kind === 'directory') {
-            if (!expandLClassReadDeny || options.denyLClassRead || path.basename(target.path) === 'triggers') {
+            // :workspace/:read-only already grants L-class read access on Windows.
+            // Omitting redundant read ACLs keeps Codex's serialized helper payload
+            // below CreateProcess' command-line limit. Readonly still needs deny.
+            const includeWindowsRead = platform !== 'win32' || options.denyLClassRead;
+            if (includeWindowsRead && (!expandLClassReadDeny || options.denyLClassRead || path.basename(target.path) === 'triggers')) {
                 lClassRules[target.path] = lClassAccess;
             }
-            if (expandLClassReadDeny || !options.denyLClassRead) {
+            if (includeWindowsRead && (expandLClassReadDeny || !options.denyLClassRead)) {
                 // Use '/**' suffix instead of path.join to satisfy Codex's glob requirement
                 lClassRules[target.path + '/**'] = lClassAccess;
             }
@@ -518,10 +634,12 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
             lClassRules[target.path] = lClassAccess;
         }
     }
-    return compactWindowsCodexFilesystemRules({
-        ...buildCodexHClassFilesystemRules(root),
+    const filesystem = compactWindowsCodexFilesystemRules({
+        ...buildCodexHClassFilesystemRules(root, platform),
         ...lClassRules,
-    });
+    }, platform);
+    assertWindowsCodexFilesystemRuleBudget(filesystem, platform);
+    return filesystem;
 }
 export function hClassGrantIncludesProtectedPath(value, options = {}) {
     const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());

package/dist/core/permission/sandbox-runtime.js

@@ -7,14 +7,46 @@ let cachedBubblewrapPath;
 let sandboxInitializationCircuit;
 const sessionSandboxInitializationCircuits = new Map();
 let sandboxCircuitNoticeAt = 0;
+let sandboxInitializationFailureCounters = emptySandboxInitializationFailureCounters();
 export const SANDBOX_INITIALIZATION_FAILED = 'sandbox_initialization_failed';
 export const SANDBOX_INITIALIZATION_COOLDOWN_MS = 5 * 60 * 1000;
 export const SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS = 60 * 1000;
+function emptySandboxInitializationFailureCounters() {
+    return {
+        total: 0,
+        applySeccomp: 0,
+        byKind: { uid_map: 0, gid_map: 0, seccomp: 0, user_namespace: 0, bubblewrap: 0, unknown: 0 },
+    };
+}
+/** Classify already recognized bootstrap evidence, never arbitrary tool output. */
+function sandboxInitializationFailureKind(text) {
+    if (/\buid_map\b/i.test(text))
+        return 'uid_map';
+    if (/\bgid_map\b/i.test(text))
+        return 'gid_map';
+    if (/\bseccomp\b/i.test(text))
+        return 'seccomp';
+    if (/user namespace/i.test(text))
+        return 'user_namespace';
+    if (/\b(?:bwrap|bubblewrap)\b/i.test(text))
+        return 'bubblewrap';
+    return 'unknown';
+}
+export function getSandboxInitializationFailureCounters() {
+    return { ...sandboxInitializationFailureCounters, byKind: { ...sandboxInitializationFailureCounters.byKind } };
+}
 const SANDBOX_DIAGNOSTIC_TARGET_LIMIT = 256;
 /** Host bootstrap failures open a process circuit; tool-result failures only
  * affect their originating session because tool output is not host attestation. */
 export function recordSandboxInitializationFailure(error, stderr = [], now = Date.now(), sessionId) {
-    const detail = createSandboxInitializationError(error, stderr).message.slice(0, 512);
+    const wrapped = createSandboxInitializationError(error, stderr);
+    const evidence = [wrapped.message, ...(wrapped.stderr ?? [])].join('\n');
+    const kind = sandboxInitializationFailureKind(evidence);
+    sandboxInitializationFailureCounters.total++;
+    sandboxInitializationFailureCounters.byKind[kind]++;
+    if (/\bapply-seccomp\b/i.test(evidence))
+        sandboxInitializationFailureCounters.applySeccomp++;
+    const detail = wrapped.message.slice(0, 512);
     getActiveSandboxInitializationFailure(now);
     const previous = sessionId ? sessionSandboxInitializationCircuits.get(sessionId) : sandboxInitializationCircuit;
     const circuit = previous
@@ -23,8 +55,9 @@ export function recordSandboxInitializationFailure(error, stderr = [], now = Dat
             lastObservedAt: now,
             occurrences: previous.occurrences + 1,
             detail,
+            kind,
         }
-        : { openedAt: now, lastObservedAt: now, occurrences: 1, detail };
+        : { openedAt: now, lastObservedAt: now, occurrences: 1, detail, kind };
     if (sessionId)
         sessionSandboxInitializationCircuits.set(sessionId, circuit);
     else
@@ -68,11 +101,13 @@ export function isSandboxInitializationFailure(error, stderr = []) {
         .join('\n')
         .toLowerCase();
     return text.includes(SANDBOX_INITIALIZATION_FAILED)
+        || /fs sandbox helper failed(?: with status)?\b/.test(text)
         || /(?:apply-seccomp|seccomp)[\s\S]*(?:uid_map|gid_map|operation not permitted)/.test(text)
         || /(?:uid_map|gid_map)[\s\S]*(?:operation not permitted|permission denied)/.test(text)
         || /user namespace[\s\S]*(?:not permitted|unavailable|failed)/.test(text)
         || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text)
-        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot|unable to)[\s\S]*(?:bind|mount|mount table)/.test(text);
+        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot|unable to)[\s\S]*(?:bind|mount|mount table)/.test(text)
+        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot) create (?:file|directory) at [^\n]+: read-only file system/.test(text);
 }
 export function createSandboxInitializationError(error, stderr = []) {
     if (error instanceof Error
@@ -98,6 +133,39 @@ export function createSandboxInitializationError(error, stderr = []) {
 export function shouldFailIfClaudeSandboxUnavailable(platform = process.platform) {
     return platform !== 'win32';
 }
+/**
+ * In an unprivileged user namespace (for example, root in an LXC container),
+ * dropping all capabilities before apply-seccomp creates its child namespace
+ * prevents that helper from writing a mapping for UID 0 (CAP_SETFCAP).
+ * Use the SDK's nested-sandbox compatibility mode only for confirmed remapped
+ * root. Unknown host state must not opt into weaker isolation.
+ */
+export function shouldEnableClaudeWeakerNestedSandbox(platform = process.platform, effectiveUid = typeof process.geteuid === 'function' ? process.geteuid() : undefined) {
+    if (platform !== 'linux' || effectiveUid !== 0)
+        return false;
+    let uidMap;
+    try {
+        uidMap = fs.readFileSync('/proc/self/uid_map', 'utf8').trim();
+    }
+    catch {
+        return false;
+    }
+    if (!uidMap)
+        return false;
+    let remappedRoot = false;
+    for (const line of uidMap.split(/\r?\n/)) {
+        const fields = line.trim().match(/^(\d+)\s+(\d+)\s+(\d+)$/);
+        if (!fields)
+            return false;
+        const [inside, outside, count] = fields.slice(1).map(Number);
+        if (![inside, outside, count].every(Number.isSafeInteger)
+            || count === 0 || inside + count > 0xffffffff || outside + count > 0xffffffff)
+            return false;
+        if (inside === 0 && outside !== 0)
+            remappedRoot = true;
+    }
+    return remappedRoot;
+}
 function isExecutableFile(candidate) {
     if (!candidate)
         return false;
@@ -586,4 +654,5 @@ export function _resetSandboxRuntimeCache() {
     cachedBubblewrapPath = undefined;
     sandboxInitializationCircuit = undefined;
     sandboxCircuitNoticeAt = 0;
+    sandboxInitializationFailureCounters = emptySandboxInitializationFailureCounters();
 }

package/dist/core/permission/tool-error-code.js

@@ -20,6 +20,21 @@ export function classifyToolErrorCode(input) {
         return 'USER_DENIED';
     return 'EXECUTION_FAILED';
 }
+/**
+ * Map the internal error taxonomy to the intentionally small AUN activity
+ * contract. The detailed code remains available to local audit consumers.
+ */
+export function classifyAunToolErrorCode(input) {
+    const code = classifyToolErrorCode(input);
+    if (code === 'POLICY_DENIED'
+        || code === 'ROLE_DENIED'
+        || code === 'USER_DENIED'
+        || code === 'APPROVAL_TIMEOUT'
+        || code === 'DELEGATION_FAILED') {
+        return 'PERMISSION_DENIED';
+    }
+    return 'EXECUTION_FAILED';
+}
 /**
  * Compatibility classifier for historical, unstructured logs only.
  * Production event producers must use classifyToolErrorCode() and explicit