evolcore 0.0.26 → 0.0.28

package/dist/core/permission/approval-gateway.js

@@ -178,6 +178,35 @@ function approvalCodeBlock(value) {
     const fence = '`'.repeat(Math.max(3, longestRun + 1));
     return `${fence}text\n${value}\n${fence}`;
 }
+function normalizeAidForApprovalRouting(value) {
+    const normalized = value?.trim().replace(/^@/, '');
+    return normalized || undefined;
+}
+function preferredOriginOwner(context, approval, owners) {
+    const originChannel = (approval?.originChannel ?? context.channel ?? '').split('#', 1)[0].toLowerCase();
+    if (context.chatType !== 'private' || originChannel !== 'aun')
+        return undefined;
+    const originPeerId = normalizeAidForApprovalRouting(approval?.originPeerId ?? context.userId);
+    if (!originPeerId)
+        return undefined;
+    return owners.find(owner => normalizeAidForApprovalRouting(owner) === originPeerId);
+}
+/**
+ * Owner approvals normally belong to the Owner's private main session. The
+ * one exception is an AUN private conversation whose peer is itself a
+ * configured Owner: preserve that conversation's topic so the request stays
+ * with the Owner's current work.
+ */
+function ownerApprovalThreadId(context, approval, approverOperatorId) {
+    const originChannel = (approval.originChannel ?? context.channel ?? '').split('#', 1)[0].toLowerCase();
+    const originPeerId = normalizeAidForApprovalRouting(approval.originPeerId ?? context.userId);
+    const approverId = normalizeAidForApprovalRouting(approverOperatorId);
+    const isOwnerPrivateConversation = context.chatType === 'private'
+        && originChannel === 'aun'
+        && !!originPeerId
+        && originPeerId === approverId;
+    return isOwnerPrivateConversation ? (approval.originThreadId ?? '') : '';
+}
 export function planApprovalRoute(challenge, context) {
     if (!challenge.grantable) {
         return { kind: 'unavailable', reason: 'challenge_not_grantable' };
@@ -235,9 +264,12 @@ export function planApprovalRoute(challenge, context) {
             approverPrincipalId: actor.principalId,
         };
     }
-    const handoffCandidates = challenge.approverPolicy === 'agent_manager'
-        ? Array.from(new Set([...admins, ...owners]))
-        : owners;
+    const preferredOwner = preferredOriginOwner(context ?? {}, routing, owners);
+    const handoffCandidates = preferredOwner
+        ? [preferredOwner]
+        : challenge.approverPolicy === 'agent_manager'
+            ? Array.from(new Set([...admins, ...owners]))
+            : owners;
     if (handoffCandidates.length === 0) {
         return {
             kind: 'unavailable',
@@ -777,6 +809,7 @@ export class PermissionGateway {
         }
         const ownerReplyContext = {
             delivery: { chatType: 'private' },
+            threadId: ownerApprovalThreadId(context, approval, route.approverOperatorId),
             metadata: {
                 source: 'handoff',
                 chatmode: 'interactive',

package/dist/core/permission/ec-command-parser.js

@@ -16,6 +16,13 @@ const CODEX_CUSTOM_POWERSHELL_NAMES = new Set(['pwsh.exe', 'powershell.exe']);
 const CODEX_CUSTOM_CMD_NAMES = new Set(['cmd.exe']);
 const CODEX_CMD_EXECUTABLES = new Set(['cmd', 'cmd.exe']);
 const CODEX_CMD_INSTALL_PATH_RE = /^[A-Za-z]:[\\/](?:Windows[\\/](?:System32|SysWOW64|Sysnative)[\\/]cmd\.exe)$/i;
+// These switches only suppress interactive/profile UI behavior. `-Command`
+// is handled separately as the required execute switch. Options such as
+// `-NoExit`, `-ExecutionPolicy`, `-EncodedCommand`, and `-File` can change
+// execution semantics and must never be accepted as a trusted carrier.
+const CODEX_POWERSHELL_INERT_SWITCHES = new Set([
+    '-noprofile', '-noninteractive', '-nologo',
+]);
 // These switches affect only cmd startup/output formatting. `/c` is handled
 // separately as the required execute switch. Flags such as `/k`, `/v:on`,
 // `/e:*`, and `/f:*` can change process lifetime or command semantics and are
@@ -222,24 +229,27 @@ export function normalizeEvolcoreCommandArgv(argv) {
     }
     return [...argv];
 }
-/** Detect the historical PowerShell pattern that overwrote the thread carrier. */
-export function hasPowerShellDelegationAssignment(command) {
-    return /^\s*\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(command)
+const POWERSHELL_CREDENTIAL_ENV_RE = /^(EVOLCORE_CODEX_SESSION_TOKEN|EVOLCORE_DELEGATION_TOKEN)$/i;
+/** Detect a PowerShell prefix that materializes an EvolCore session credential. */
+export function hasPowerShellCredentialAssignment(command) {
+    return /^\s*\$env\s*:\s*(?:EVOLCORE_CODEX_SESSION_TOKEN|EVOLCORE_DELEGATION_TOKEN)\b/i.test(command)
         && /\bec(?:\.cmd|\.exe)?(?:\s|$)/i.test(command);
 }
 /**
  * Windows Codex may materialize one environment variable assignment directly
  * in the PowerShell command body instead of inheriting it from the process
- * environment. Only the EvolCore delegation variable is accepted, and only
- * when followed by one command on the same carrier. The value is validated for
- * shape but never trusted for authorization; the runner still arms the stable
- * in-memory thread carrier.
+ * environment. Only an EvolCore session credential variable is accepted,
+ * and only when followed by one command in the same shell invocation. The
+ * legacy delegation name remains readable for rolling upgrades, but its value
+ * is still compared with the credential bound to the managed session.
  */
-function unwrapPowerShellDelegationPrefix(command) {
+function unwrapPowerShellCredentialPrefix(command) {
     const input = command.trim();
-    if (!/^\$env\s*:\s*EVOLCORE_DELEGATION_TOKEN\b/i.test(input)) {
+    const prefix = input.match(/^\$env\s*:\s*([A-Za-z_][A-Za-z0-9_]*)\b/i);
+    if (!prefix || !POWERSHELL_CREDENTIAL_ENV_RE.test(prefix[1])) {
         return { kind: 'none', command };
     }
+    const credentialEnvName = prefix[1];
     let index = 0;
     const skipSpace = () => {
         while (index < input.length && (input[index] === ' ' || input[index] === '\t'))
@@ -256,7 +266,7 @@ function unwrapPowerShellDelegationPrefix(command) {
         return { kind: 'invalid', command };
     index++;
     skipSpace();
-    if (!consume('EVOLCORE_DELEGATION_TOKEN'))
+    if (!consume(credentialEnvName))
         return { kind: 'invalid', command };
     skipSpace();
     if (input[index] !== '=')
@@ -328,20 +338,20 @@ export function parseCodexCarrierCommand(carrier, options = {}) {
         }
     }
     const unwrapped = carrier.dialect === 'powershell'
-        ? unwrapPowerShellDelegationPrefix(carrier.command)
+        ? unwrapPowerShellCredentialPrefix(carrier.command)
         : { kind: 'none', command: carrier.command };
     // Windows PowerShell may materialize the thread's shell environment as a
-    // single `$env:EVOLCORE_DELEGATION_TOKEN = '...'` prefix. Keep the token as
+    // single `$env:EVOLCORE_CODEX_SESSION_TOKEN = '...'` prefix. Keep the token as
     // metadata for the approval layer, which must compare it with the runner's
-    // in-memory carrier before arming delegation. Malformed or unrelated
+    // session credential before arming delegation. Malformed or unrelated
     // assignments remain syntax failures and can never be authorized.
     if (unwrapped.kind === 'invalid'
         || (carrier.dialect === 'powershell'
-            && hasPowerShellDelegationAssignment(carrier.command)
+            && hasPowerShellCredentialAssignment(carrier.command)
             && unwrapped.kind === 'none')
         || (unwrapped.kind === 'valid'
-            && options.expectedDelegationToken !== undefined
-            && options.expectedDelegationToken !== unwrapped.token)) {
+            && options.expectedCredentialToken !== undefined
+            && options.expectedCredentialToken !== unwrapped.token)) {
         return parseFailure('shell-composition', carrier.command, 0, 0, carrier.dialect);
     }
     const parsed = parseLiteralShellCommand(unwrapped.command, {
@@ -352,7 +362,7 @@ export function parseCodexCarrierCommand(carrier, options = {}) {
         ? {
             ...parsed,
             argv: normalizeEvolcoreCommandArgv(parsed.argv),
-            ...(unwrapped.kind === 'valid' ? { delegationToken: unwrapped.token } : {}),
+            ...(unwrapped.kind === 'valid' ? { credentialToken: unwrapped.token } : {}),
         }
         : parsed;
 }
@@ -366,6 +376,14 @@ function parseFailure(issue, input, offset, tokenIndex, dialect) {
         inputLength: input.length,
     };
 }
+// PowerShell uses smart quotes as delimiters, including when the opening
+// quote was ASCII. Treating them as text changes argv and delegation hashes.
+function isPowerShellSingleQuote(char) {
+    return char !== undefined && /['\u2018\u2019\u201a\u201b]/u.test(char);
+}
+function isPowerShellDoubleQuote(char) {
+    return char !== undefined && /["\u201c\u201d\u201e]/u.test(char);
+}
 function parseLiteralPowerShellCommand(command, options = {}) {
     const input = trimShellSpacing(command);
     if (!input)
@@ -389,11 +407,11 @@ function parseLiteralPowerShellCommand(command, options = {}) {
     for (let index = 0; index < input.length; index++) {
         const char = input[index];
         if (quote === 'single') {
-            if (char === "'" && input[index + 1] === "'") {
-                token += "'";
+            if (isPowerShellSingleQuote(char) && isPowerShellSingleQuote(input[index + 1])) {
+                token += input[index + 1];
                 index++;
             }
-            else if (char === "'") {
+            else if (isPowerShellSingleQuote(char)) {
                 if (!isLiteralArgBoundary(input[index + 1]))
                     return parseFailure('invalid-quote', input, index, argv.length, 'powershell');
                 quote = null;
@@ -410,7 +428,7 @@ function parseLiteralPowerShellCommand(command, options = {}) {
                 return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
             }
             if (!options.allowManagedTmpDir || !options.managedTempDir
-                || (next !== undefined && !/[\\/\s"']/u.test(next))) {
+                || (next !== undefined && !/[\\/\s"']/u.test(next) && !isPowerShellSingleQuote(next) && !isPowerShellDoubleQuote(next))) {
                 return parseFailure('unsafe-expansion', input, index, argv.length, 'powershell');
             }
             // Append the registered value directly: spaces remain in this argument,
@@ -421,7 +439,7 @@ function parseLiteralPowerShellCommand(command, options = {}) {
             continue;
         }
         if (quote === 'double') {
-            if (char === '"') {
+            if (isPowerShellDoubleQuote(char)) {
                 if (!isLiteralArgBoundary(input[index + 1]))
                     return parseFailure('invalid-quote', input, index, argv.length, 'powershell');
                 quote = null;
@@ -448,12 +466,12 @@ function parseLiteralPowerShellCommand(command, options = {}) {
         if (/\s/u.test(char) || char.charCodeAt(0) < 0x20 || char === '\x7f') {
             return parseFailure('invalid-control-char', input, index, argv.length, 'powershell');
         }
-        if (char === "'") {
+        if (isPowerShellSingleQuote(char)) {
             tokenStarted = true;
             quote = 'single';
             continue;
         }
-        if (char === '"') {
+        if (isPowerShellDoubleQuote(char)) {
             tokenStarted = true;
             quote = 'double';
             continue;
@@ -599,6 +617,25 @@ function resolveCodexCmdCarrierArgv(argv) {
         ? { command, dialect: 'cmd', executable: argv[0] }
         : undefined;
 }
+function resolveCodexPowerShellCarrierArgv(argv) {
+    if (argv.length < 3 || !isCodexPowerShellExecutable(argv[0]))
+        return undefined;
+    const commandIndex = argv.length - 2;
+    if (argv[commandIndex].toLowerCase() !== '-command')
+        return undefined;
+    const seen = new Set();
+    for (const rawSwitch of argv.slice(1, commandIndex)) {
+        const switchValue = rawSwitch.toLowerCase();
+        if (!CODEX_POWERSHELL_INERT_SWITCHES.has(switchValue) || seen.has(switchValue)) {
+            return undefined;
+        }
+        seen.add(switchValue);
+    }
+    const command = argv.at(-1);
+    return typeof command === 'string' && command.trim()
+        ? { command, dialect: 'powershell', executable: argv[0] }
+        : undefined;
+}
 /** Resolve a Windows cmd carrier when the app-server provides only a string. */
 function resolveCodexCmdCarrierString(command) {
     const input = trimShellSpacing(command);
@@ -614,10 +651,14 @@ function resolveCodexCmdCarrierString(command) {
     const argv = [executable, ...switches, match[4]];
     return resolveCodexCmdCarrierArgv(argv);
 }
-/** Resolve a PowerShell carrier when the app-server provides only a string. */
+/**
+ * Resolve a PowerShell carrier when the app-server provides only a string.
+ * The prefix is converted to the same argv shape used by commandArgv so the
+ * startup-switch policy cannot diverge between the two transport forms.
+ */
 function resolveCodexPowerShellCarrierString(command) {
     const input = trimShellSpacing(command);
-    const match = input.match(/^(?:"([^"]+)"|(\S+))\s+-command\s+(.+)$/i);
+    const match = input.match(/^(?:"([^"\r\n]+)"|(\S+))((?:[ \t]+-[A-Za-z]+)+)[ \t]+(.+)$/);
     if (!match)
         return undefined;
     const executable = match[1] ?? match[2];
@@ -626,13 +667,14 @@ function resolveCodexPowerShellCarrierString(command) {
     // A string-form carrier has one additional command-line quoting layer. The
     // command argument is commonly serialized as `"ec ..."`; remove exactly
     // that outer pair and leave quotes belonging to EC arguments intact.
-    let nested = match[3].trim();
+    let nested = match[4].trim();
     if (nested.length >= 2
         && ((nested.startsWith('"') && nested.endsWith('"'))
             || (nested.startsWith("'") && nested.endsWith("'")))) {
         nested = nested.slice(1, -1);
     }
-    return nested ? { command: nested, dialect: 'powershell', executable } : undefined;
+    const switches = match[3].trim().split(/[ \t]+/);
+    return resolveCodexPowerShellCarrierArgv([executable, ...switches, nested]);
 }
 /** Resolve a POSIX shell carrier when app-server provides only a string. */
 function resolveCodexPosixShellCarrierString(command) {
@@ -868,11 +910,9 @@ export function resolveCodexShellCarrierArgv(argv) {
         && isCodexPosixShellExecutable(argv[0])) {
         return { command: argv[2], dialect: 'posix', executable: argv[0] };
     }
-    if (argv.length === 3) {
-        if (isCodexPowerShellExecutable(argv[0]) && argv[1].toLowerCase() === '-command') {
-            return { command: argv[2], dialect: 'powershell', executable: argv[0] };
-        }
-    }
+    const powershellCarrier = resolveCodexPowerShellCarrierArgv(argv);
+    if (powershellCarrier)
+        return powershellCarrier;
     // Node/cross-spawn and Codex use cmd.exe with a small set of startup flags.
     // The execute switch must be the final switch before one command argument;
     // validation itself is shared with string-only Windows payloads below.
@@ -1645,7 +1685,7 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
             if (!nested.ok && (hasCarrierEcCommandPrefix(carrier.command, carrier.dialect)
-                || (carrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(carrier.command)))) {
+                || (carrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(carrier.command)))) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
@@ -1655,7 +1695,7 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
             if (nested.ok && nested.argv[0] === 'ec')
                 return { kind: 'literal' };
             if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
-                || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
+                || (stringCarrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(stringCarrier.command)))) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
@@ -1677,7 +1717,7 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
         if (nested.ok && nested.argv[0] === 'ec')
             return { kind: 'literal' };
         if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
-            || (stringCarrier.dialect === 'powershell' && hasPowerShellDelegationAssignment(stringCarrier.command)))) {
+            || (stringCarrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(stringCarrier.command)))) {
             return { kind: 'composite', issue: nested.issue };
         }
         return { kind: 'none' };

package/dist/core/permission/protected-paths.js

@@ -28,9 +28,13 @@ const H_CLASS_RELATIVE_PATTERNS = [
     /^data\/outbox(?:\/|$)/,
     /^data\/handoff(?:\/|$)/,
     /^agents\/[^/]+\/sessions(?:\/|$)/,
+    /^agents\/[^/]+\/data\/async-questions(?:\/|$)/,
+    /^agents\/[^/]+\/data\/aun(?:\/|$)/,
     /^agents\/[^/]+\/data\/(?:channels(?:\/|$)|handoff(?:\/|$)|(?:outbox|activity-outbox)\.jsonl(?:_|__|\.tmp-.*)?$|contact-audit\.jsonl$)/,
 ];
 const H_CLASS_REFERENCE_PATTERNS = [
+    /(?:^|[/\\\s"'=<>])agents[\\/][^/\\\s"']+[\\/]data[\\/]async-questions(?:[\\/]|$|[\s"';&|<>)},])/,
+    /(?:^|[/\\\s"'=<>])agents[\\/][^/\\\s"']+[\\/]data[\\/]aun(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[^A-Za-z0-9_.-])daemon\.json(?=$|[^A-Za-z0-9_.-])/,
     /(?:^|[^A-Za-z0-9_.-])agents[\\/](?:defaults\.json|[^/\\\s"']+[\\/](?:(?:config|contact)\.json|contact-operations\.jsonl|relations[\\/][^/\\\s"']+[\\/]config\.json))(?=$|[\s"';&|<>)},])/,
     /(?:^|[^A-Za-z0-9_.-])(?:backups[\\/]config|\.snapshots|CA|(?:AIDs|aids)[\\/][^/\\\s"']+[\\/](?:cert|keys|private))(?:[\\/]|$|[\s"';&|<>)},])/,
@@ -43,6 +47,8 @@ const H_CLASS_REFERENCE_PATTERNS = [
 // protected file. Descendants inherit the directory classification unless an
 // existing regular file gives us a more precise answer.
 const H_CLASS_DIRECTORY_RELATIVE_PATTERNS = [
+    /^agents\/[^/]+\/data\/aun(?:\/|$)/,
+    /^agents\/[^/]+\/data\/async-questions(?:\/|$)/,
     /^backups\/config(?:\/|$)/,
     /^\.snapshots(?:\/|$)/,
     /^CA(?:\/|$)/,
@@ -286,6 +292,8 @@ export function getHClassSandboxPatterns(root = resolveRoot()) {
         path.join('agents', '*', 'sessions', '**'),
         path.join('agents', '*', 'data', 'channels', '**'),
         path.join('agents', '*', 'data', 'handoff', '**'),
+        path.join('agents', '*', 'data', 'async-questions', '**'),
+        path.join('agents', '*', 'data', 'aun', '**'),
         path.join('agents', '*', 'data', 'outbox.jsonl*'),
         path.join('agents', '*', 'data', 'activity-outbox.jsonl*'),
         path.join('agents', '*', 'data', 'contact-audit.jsonl'),
@@ -303,6 +311,15 @@ export function getLClassWritePatterns(root = resolveRoot()) {
 const CLAUDE_PROTECTED_TARGET_LIMIT = 8192;
 const CLAUDE_GLOB_MAGIC = /[*?[\]]/;
 const CODEX_GLOB_MAGIC = /[*?[\]]/;
+// Codex wraps the resolved Windows ACL payload in JSON and base64 before
+// passing it as one CreateProcess argument.  Real Codex 0.154 payloads are
+// roughly 3-5x larger than EvolCore's input map, so leave enough room below
+// Windows' 32,767-character command-line ceiling for helper metadata.
+const CODEX_WINDOWS_FILESYSTEM_RULE_BUDGET_BYTES = 7 * 1024;
+const CODEX_WINDOWS_MATERIALIZED_FILE_GLOBS = [
+    '**/*.json_',
+    '**/*.json.migrated',
+];
 function addExistingTarget(targets, value) {
     try {
         const stat = fs.lstatSync(value);
@@ -370,6 +387,8 @@ export function getExistingHClassMaskTargets(root = resolveRoot()) {
             addExistingTarget(targets, path.join(agentRoot, 'sessions'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'channels'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'handoff'));
+            addExistingTarget(targets, path.join(agentRoot, 'data', 'async-questions'));
+            addExistingTarget(targets, path.join(agentRoot, 'data', 'aun'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'outbox.jsonl'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'activity-outbox.jsonl'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'contact-audit.jsonl'));
@@ -427,14 +446,14 @@ export function buildClaudeProtectedFilesystem(root = resolveRoot(), options = {
         denyWrite: allPaths,
     };
 }
-export function buildCodexHClassFilesystemRules(root = resolveRoot()) {
+export function buildCodexHClassFilesystemRules(root = resolveRoot(), platform = process.platform) {
     const filesystem = {
         // Codex pre-expands unbounded deny globs on Linux/WSL/Windows. Without a
         // bound, patterns such as **/*.json_ are accepted but may not be enforced.
         glob_scan_max_depth: 64,
-        ...Object.fromEntries(filterWindowsCodexFilesystemTargets(getHClassSandboxPatterns(root)).map(pattern => [pattern, 'deny'])),
+        ...Object.fromEntries(filterWindowsCodexFilesystemTargets(getHClassSandboxPatterns(root), platform).map(pattern => [pattern, 'deny'])),
     };
-    return compactWindowsCodexFilesystemRules(filesystem);
+    return materializeWindowsCodexRecursiveFileDenies(compactWindowsCodexFilesystemRules(filesystem, platform), root, platform);
 }
 /**
  * Windows Codex sandbox setup materializes a path while applying its deny-read
@@ -462,20 +481,21 @@ export function filterWindowsCodexFilesystemTargets(patterns, platform = process
     });
 }
 /**
- * Codex expands recursive deny globs into individual targets. Large protected
+ * Codex expands recursive ACL globs into individual targets. Large protected
  * trees on Windows can then fail during AGENTS.md loading with os error 206.
- * Directory denies inherit to descendants through the Windows sandbox ACLs,
- * avoiding redundant targets. Keep broad recursive filename globs intact.
+ * Directory deny/read ACLs inherit to descendants, avoiding redundant targets.
+ * Keep broad recursive filename globs intact for the materialization pass.
  */
 export function compactWindowsCodexFilesystemRules(filesystem, platform = process.platform) {
     if (platform !== 'win32')
         return filesystem;
     const compacted = {};
+    const projectedKeys = new Map();
     for (const [pattern, access] of Object.entries(filesystem)) {
-        const isTerminalRecursiveDeny = access === 'deny'
+        const isTerminalRecursiveAcl = (access === 'deny' || access === 'read')
             && (pattern.endsWith('/**') || pattern.endsWith('\\**'));
-        const recursiveRoot = isTerminalRecursiveDeny ? pattern.slice(0, -3) : undefined;
-        // Only collapse a recursive deny when its root is a real directory.  A
+        const recursiveRoot = isTerminalRecursiveAcl ? pattern.slice(0, -3) : undefined;
+        // Only collapse a recursive ACL when its root is a real directory.  A
         // missing root must remain a glob: turning it into an exact target can
         // make the Windows sandbox materialize that path as a directory.
         const canCompact = !!recursiveRoot
@@ -488,12 +508,104 @@ export function compactWindowsCodexFilesystemRules(filesystem, platform = proces
                 }
             })());
         const compactPattern = canCompact ? recursiveRoot : pattern;
-        if (compacted[compactPattern] !== 'deny')
-            compacted[compactPattern] = access;
+        let projectedPattern = compactPattern;
+        {
+            // Resolve only the literal prefix and only casing aliases. Do not fold
+            // glob spelling, unresolved paths, case-sensitive directories or links.
+            const globIndex = compactPattern.search(CODEX_GLOB_MAGIC);
+            const prefix = globIndex < 0 ? compactPattern : compactPattern.slice(0, Math.max(compactPattern.lastIndexOf('/', globIndex), compactPattern.lastIndexOf('\\', globIndex)));
+            let key = compactPattern;
+            try {
+                const canonical = fs.realpathSync.native(prefix);
+                if (canonical.toLowerCase() === prefix.toLowerCase())
+                    key = canonical + compactPattern.slice(prefix.length);
+            }
+            catch { /* An unresolved alias must retain its deny rule. */ }
+            projectedPattern = projectedKeys.get(key) ?? compactPattern;
+            projectedKeys.set(key, projectedPattern);
+        }
+        if (compacted[projectedPattern] !== 'deny')
+            compacted[projectedPattern] = access;
+    }
+    // Directory deny ACLs inherit. After H/L rules are combined, omit exact
+    // file denies already covered by an existing directory deny. Keep globs
+    // and any child for which a read/write override could change precedence.
+    const entries = Object.entries(compacted);
+    const denyDirectories = entries.filter(([pattern, access]) => {
+        if (access !== 'deny' || CODEX_GLOB_MAGIC.test(pattern))
+            return false;
+        try {
+            return fs.lstatSync(pattern).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    }).map(([pattern]) => pattern);
+    for (const [pattern, access] of entries) {
+        if (access !== 'deny' || CODEX_GLOB_MAGIC.test(pattern) || denyDirectories.includes(pattern))
+            continue;
+        if (denyDirectories.some(parent => isSameOrDescendant(pattern, parent)
+            && !entries.some(([override, value]) => (value === 'read' || value === 'write')
+                && (CODEX_GLOB_MAGIC.test(override) || isSameOrDescendant(override, parent))))) {
+            delete compacted[pattern];
+        }
     }
     return compacted;
 }
+/**
+ * Codex 0.154 serializes resolved Windows deny-read targets into a base64
+ * command-line argument for codex-windows-sandbox-setup.exe.  Recursive file
+ * globs can expand into enough absolute paths to exceed CreateProcess' command
+ * line limit.  Claude avoids the analogous limit by externalizing settings;
+ * Codex has no per-thread settings-file input, so materialize only these broad
+ * file globs in EvolCore and keep the compact exact projection in thread config.
+ *
+ * Matches below an already denied directory are omitted because the Windows
+ * sandbox ACL on that directory inherits to descendants.  Other H-class rules
+ * remain dynamic globs, preserving protection for newly created agent/config
+ * paths without recreating the unbounded recursive expansion.
+ */
+export function materializeWindowsCodexRecursiveFileDenies(filesystem, root = resolveRoot(), platform = process.platform) {
+    if (platform !== 'win32')
+        return filesystem;
+    const absoluteRoot = resolveThroughExistingAncestor(root);
+    const materializedPatterns = new Set(CODEX_WINDOWS_MATERIALIZED_FILE_GLOBS.map(pattern => path.join(absoluteRoot, pattern)));
+    const deniedDirectories = getExistingHClassMaskTargets(absoluteRoot)
+        .filter(target => target.kind === 'directory')
+        .map(target => target.path);
+    const projected = {};
+    for (const [pattern, access] of Object.entries(filesystem)) {
+        if (access !== 'deny' || !materializedPatterns.has(pattern)) {
+            projected[pattern] = access;
+            continue;
+        }
+        const relativePattern = path.relative(absoluteRoot, pattern).split(path.sep).join('/');
+        let matches;
+        try {
+            matches = fs.globSync(relativePattern, { cwd: absoluteRoot });
+        }
+        catch (error) {
+            throw new Error(`[CodexSandbox] failed to materialize Windows protected-file rules: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        for (const match of matches) {
+            const candidate = path.resolve(absoluteRoot, match);
+            if (deniedDirectories.some(directory => isSameOrDescendant(candidate, directory)))
+                continue;
+            projected[candidate] = access;
+        }
+    }
+    return projected;
+}
+export function assertWindowsCodexFilesystemRuleBudget(filesystem, platform = process.platform) {
+    if (platform !== 'win32')
+        return;
+    const bytes = Buffer.byteLength(JSON.stringify(filesystem), 'utf8');
+    if (bytes > CODEX_WINDOWS_FILESYSTEM_RULE_BUDGET_BYTES) {
+        throw new Error(`[CodexSandbox] Windows filesystem rule budget exceeded: ${bytes} > ${CODEX_WINDOWS_FILESYSTEM_RULE_BUDGET_BYTES}`);
+    }
+}
 export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options = {}) {
+    const platform = options.platform ?? process.platform;
     const lClassRules = {};
     const lClassAccess = options.denyLClassRead ? 'deny' : 'read';
     // Codex's Linux sandbox expands glob deny rules into per-file mount targets.
@@ -506,10 +618,14 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
     const expandLClassReadDeny = options.expandLClassReadDeny ?? true;
     for (const target of getExistingLClassReadOnlyTargets(root)) {
         if (target.kind === 'directory') {
-            if (!expandLClassReadDeny || options.denyLClassRead || path.basename(target.path) === 'triggers') {
+            // :workspace/:read-only already grants L-class read access on Windows.
+            // Omitting redundant read ACLs keeps Codex's serialized helper payload
+            // below CreateProcess' command-line limit. Readonly still needs deny.
+            const includeWindowsRead = platform !== 'win32' || options.denyLClassRead;
+            if (includeWindowsRead && (!expandLClassReadDeny || options.denyLClassRead || path.basename(target.path) === 'triggers')) {
                 lClassRules[target.path] = lClassAccess;
             }
-            if (expandLClassReadDeny || !options.denyLClassRead) {
+            if (includeWindowsRead && (expandLClassReadDeny || !options.denyLClassRead)) {
                 // Use '/**' suffix instead of path.join to satisfy Codex's glob requirement
                 lClassRules[target.path + '/**'] = lClassAccess;
             }
@@ -518,10 +634,12 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
             lClassRules[target.path] = lClassAccess;
         }
     }
-    return compactWindowsCodexFilesystemRules({
-        ...buildCodexHClassFilesystemRules(root),
+    const filesystem = compactWindowsCodexFilesystemRules({
+        ...buildCodexHClassFilesystemRules(root, platform),
         ...lClassRules,
-    });
+    }, platform);
+    assertWindowsCodexFilesystemRuleBudget(filesystem, platform);
+    return filesystem;
 }
 export function hClassGrantIncludesProtectedPath(value, options = {}) {
     const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());