evolcore 0.0.27 → 0.0.29-test.0

package/dist/core/permission/tool-policy.js

@@ -4,8 +4,8 @@ import os from 'os';
 import { randomUUID } from 'crypto';
 import { logger } from '../../utils/logger.js';
 import { resolveRoot } from '../../paths.js';
-import { containsHClassReference, containsLClassReference, checkProtectedPathAccess, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, resolveProtectedCandidateWithoutFinalSymlink, } from './protected-paths.js';
-import { classifyEvolcoreShellCommand, hasCodexCmdCarrierEcIntent, hasPowerShellCredentialAssignment, parseCodexToolCommand, parseBoundedOutputShellCommand, parseLiteralShellArgv, resolveCodexShellCarrierArgv, resolveCodexShellCarrierString, } from './ec-command-parser.js';
+import { containsHClassReference, containsAgentScopeReference, containsLClassReference, checkProtectedPathAccess, getExistingHClassMaskTargets, hClassGrantIncludesProtectedPath, isHClassPath, isSameOrDescendant, isLClassPath, lClassGrantIncludesProtectedPath, resolveProtectedCandidate, resolveProtectedCandidateWithoutFinalSymlink, } from './protected-paths.js';
+import { classifyEvolcoreShellCommand, hasCodexCmdCarrierEcIntent, hasPowerShellCredentialAssignment, parseCodexToolCommand, parseBoundedOutputShellCommand, parseShellApplyPatchInvocation, parseLiteralShellArgv, resolveCodexShellCarrierArgv, resolveCodexShellCarrierString, } from './ec-command-parser.js';
 import { analyzeReadonlyShellQuery, } from './readonly-shell-query.js';
 /** Resolve the session-owned temporary root supplied by the execution host. */
 export function resolveManagedTempDir(env = process.env) {
@@ -88,6 +88,99 @@ export function checkManagedTempShellCommand(command, options = {}) {
     }
     return { kind: 'allow', paths: uniqueCandidates };
 }
+function sharedTemporaryRoots(options) {
+    if (process.platform === 'win32')
+        return windowsTempRoots(options);
+    return ['/tmp', '/var/tmp', '/dev/shm']
+        .map(value => resolveProtectedCandidate(value))
+        .filter((value, index, values) => values.indexOf(value) === index);
+}
+function collectManagedTempToolPaths(toolName, input) {
+    const paths = [];
+    if (toolName === 'FileChange') {
+        if (typeof input.grantRoot === 'string' && input.grantRoot)
+            paths.push(input.grantRoot);
+        collectFileChangePaths(input.fileChanges, paths);
+    }
+    else if (['Write', 'Edit', 'NotebookEdit'].includes(toolName)) {
+        for (const key of ['file_path', 'notebook_path', 'path']) {
+            if (typeof input[key] === 'string' && input[key])
+                paths.push(input[key]);
+        }
+    }
+    else if (toolName === 'PermissionGrant') {
+        if (typeof input.grantRoot === 'string' && input.grantRoot)
+            paths.push(input.grantRoot);
+        collectFilesystemWriteGrantPaths(input.permissions, paths);
+        collectFilesystemWriteGrantPaths(input.additionalPermissions, paths);
+    }
+    return [...new Set(paths)];
+}
+/**
+ * Enforce the session temporary boundary for path-oriented tools before a
+ * runner-specific approval flow. Project paths remain governed by the normal
+ * H/L-class and workspace policies; only temporary-looking operands are
+ * restricted to the current managed TMPDIR.
+ */
+export function checkManagedTempToolPaths(toolName, input, options = {}) {
+    const candidates = collectManagedTempToolPaths(toolName, input);
+    if (candidates.length === 0)
+        return { kind: 'none' };
+    const root = resolveManagedTempDir(options.env);
+    const workspace = options.workspacePath
+        ? resolveProtectedCandidate(options.workspacePath, options.cwd)
+        : undefined;
+    const temporaryRoots = sharedTemporaryRoots(options);
+    const outside = [];
+    let hardLink;
+    for (const rawCandidate of candidates) {
+        const explicitManagedTemp = /^\$(?:\{TMPDIR\}|TMPDIR)(?:[\\/]|$)/.test(rawCandidate.trim());
+        const expanded = substituteTmpDir(rawCandidate, root);
+        const lexical = path.isAbsolute(expanded)
+            ? path.resolve(expanded)
+            : path.resolve(options.cwd ?? process.cwd(), expanded);
+        const canonical = resolveProtectedCandidate(lexical, options.cwd);
+        const canonicalInWorkspace = !!workspace && isSameOrDescendant(canonical, workspace);
+        const lexicalInManagedTemp = !!root && isSameOrDescendant(lexical, root);
+        const canonicalInManagedTemp = !!root && isSameOrDescendant(canonical, root);
+        const temporaryLooking = explicitManagedTemp
+            || lexicalInManagedTemp
+            || temporaryRoots.some(tempRoot => isSameOrDescendant(lexical, tempRoot))
+            || temporaryRoots.some(tempRoot => isSameOrDescendant(canonical, tempRoot));
+        if (canonicalInWorkspace && !explicitManagedTemp)
+            continue;
+        if (!temporaryLooking)
+            continue;
+        if (!root || !canonicalInManagedTemp) {
+            outside.push(rawCandidate);
+            continue;
+        }
+        try {
+            const stat = fs.statSync(canonical);
+            if (stat.isFile() && stat.nlink > 1)
+                hardLink = canonical;
+        }
+        catch {
+            // A new target is valid when its canonical existing ancestor is inside
+            // the managed root; the runner will create it after this preflight.
+        }
+    }
+    if (hardLink) {
+        return {
+            kind: 'deny',
+            paths: [hardLink],
+            reason: 'managed TMPDIR target is a hard link and cannot be safely modified',
+        };
+    }
+    if (outside.length > 0) {
+        return {
+            kind: 'deny',
+            paths: outside,
+            reason: 'temporary path is outside the session-managed TMPDIR',
+        };
+    }
+    return { kind: 'none' };
+}
 /**
  * Replace only already-validated temporary path operands before a second
  * policy pass. This prevents a harmless `$TMPDIR/CA/root` name from looking
@@ -689,7 +782,7 @@ function protectedClassPath(value, className, options) {
     if (!looksLikeLiteralShellPath(value))
         return undefined;
     const matched = className === 'h'
-        ? (containsHClassReference(value) || isHClassPath(value, options))
+        ? (containsHClassReference(value, options) || containsAgentScopeReference(value, options) || isHClassPath(value, options))
         : (containsLClassReference(value) || isLClassPath(value, options));
     return matched ? resolveProtectedCandidate(value, options.cwd) : undefined;
 }
@@ -942,6 +1035,35 @@ function literalGitOperands(argv) {
 function literalReadonlyOperands(argv) {
     const executable = commandName(argv[0]);
     const args = argv.slice(1);
+    if (['get-content', 'gc', 'type'].includes(executable)) {
+        const values = [];
+        const pathOptions = new Set(['-path', '-literalpath', '-pspath']);
+        const optionsWithValues = new Set([
+            ...pathOptions,
+            '-filter', '-include', '-exclude', '-encoding', '-readcount', '-totalcount',
+            '-delimiter', '-raw', '-wait', '-tail', '-stream', '-force', '-credential',
+        ]);
+        for (let index = 0; index < args.length; index++) {
+            const argument = args[index];
+            const option = argument.split('=', 1)[0].toLowerCase();
+            if (argument.startsWith('-')) {
+                if (pathOptions.has(option)) {
+                    const value = argument.includes('=') ? argument.slice(argument.indexOf('=') + 1) : args[index + 1];
+                    if (value) {
+                        values.push(value);
+                        if (!argument.includes('='))
+                            index++;
+                    }
+                    continue;
+                }
+                if (optionsWithValues.has(option) && !argument.includes('=') && index + 1 < args.length)
+                    index++;
+                continue;
+            }
+            values.push(argument);
+        }
+        return values;
+    }
     if (['cat', 'ls', 'head', 'sort', 'wc', 'stat', 'lstat'].includes(executable)) {
         const valueOptions = new Set(['-c', '--format', '--printf', '-I', '-T', '-w', '--block-size', '--color', '--format', '--hide', '--ignore', '--key', '--parallel', '--sort']);
         const values = [];
@@ -1164,7 +1286,9 @@ function shellOperandMatchesClass(operand, className, options, accessKind = oper
             return undefined;
         }
     }
-    const reference = className === 'h' ? containsHClassReference(operand.value) : containsLClassReference(operand.value);
+    const reference = className === 'h'
+        ? (containsHClassReference(operand.value, options) || containsAgentScopeReference(operand.value, options))
+        : containsLClassReference(operand.value);
     if (reference)
         return resolveProtectedCandidate(operand.value, options.cwd);
     if (operand.access === 'recursive') {
@@ -1192,12 +1316,12 @@ function hClassReadScopeIncludesProtectedPath(value, options) {
         return true;
     if (!isSameOrDescendant(scope, root))
         return false;
-    return getExistingHClassMaskTargets(root).some(target => isSameOrDescendant(target.path, scope));
+    return getExistingHClassMaskTargets(root, { selfAid: options.selfAid }).some(target => isSameOrDescendant(target.path, scope));
 }
 function analyzeShellProtectedOperands(command, options) {
     const analysis = analyzeReadonlyShellQuery(command, { managedTempDir: options.managedTempDir });
     if (analysis.kind === 'unproven') {
-        const pathOptions = { cwd: options.cwd, root: options.root };
+        const pathOptions = { cwd: options.cwd, root: options.root, selfAid: options.selfAid };
         const hClassPath = literalProtectedShellOperand(command, 'h', pathOptions);
         const lClassPath = literalProtectedShellOperand(command, 'l', pathOptions);
         return {
@@ -1272,7 +1396,7 @@ function protectedReadToolMatchesLClass(toolName, input, options) {
     }
     if (toolName === 'Glob') {
         const scope = globReadScope(input, options);
-        return lClassGrantIncludesProtectedPath(scope, { root: options.root })
+        return lClassGrantIncludesProtectedPath(scope, { root: options.root, selfAid: options.selfAid })
             ? resolveProtectedCandidate(scope, options.cwd)
             : undefined;
     }
@@ -1280,7 +1404,9 @@ function protectedReadToolMatchesLClass(toolName, input, options) {
 }
 function protectedReadToolMatchesHClass(toolName, input, options) {
     const paths = protectedReadToolPaths(toolName, input);
-    const direct = paths.find(filePath => containsHClassReference(filePath) || isHClassPath(filePath, options));
+    const direct = paths.find(filePath => containsHClassReference(filePath, options)
+        || containsAgentScopeReference(filePath, options)
+        || isHClassPath(filePath, options));
     if (direct) {
         return resolveProtectedCandidate(direct, options.cwd);
     }
@@ -1447,11 +1573,13 @@ export function checkReadonly(toolName, input, projectPath, context) {
     ]);
     if (readOnlyTools.has(toolName)) {
         const paths = protectedReadToolPaths(toolName, input);
-        const pathOptions = { cwd: projectPath, root: context?.root };
+        const pathOptions = { cwd: projectPath, root: context?.root, selfAid: context?.selfAid };
         if (!protectedReadToolStaysInWorkspace(toolName, input, projectPath)) {
             return { behavior: 'deny', message: '🔒 只读模式：文件读取范围不能越出当前项目目录', policyCode: 'readonly_workspace_escape' };
         }
-        const directHPath = paths.find(filePath => containsHClassReference(filePath) || isHClassPath(filePath, pathOptions));
+        const directHPath = paths.find(filePath => containsHClassReference(filePath, pathOptions)
+            || containsAgentScopeReference(filePath, pathOptions)
+            || isHClassPath(filePath, pathOptions));
         if (directHPath) {
             return { behavior: 'deny', message: '🔒 只读模式：不允许读取 H 类受保护路径', policyCode: 'readonly_h_class_read', matchedPath: resolveProtectedCandidate(directHPath, projectPath) };
         }
@@ -1480,6 +1608,7 @@ export function checkReadonly(toolName, input, projectPath, context) {
             : context?.managedTempDir ?? resolveManagedTempDir();
         const protectedOperands = analyzeShellProtectedOperands(cmd, {
             cwd: projectPath,
+            selfAid: context?.selfAid,
             root: context?.root,
             managedTempDir,
             allowProtectedMetadata: context?.allowProtectedMetadata,
@@ -1725,6 +1854,32 @@ function collectFileChangePaths(value, output) {
         }
     }
 }
+function applyPatchChangePaths(changes) {
+    const paths = [];
+    for (const change of changes) {
+        paths.push(change.path);
+        if (change.movePath)
+            paths.push(change.movePath);
+    }
+    return paths;
+}
+function applyPatchWorkspaceEscape(changes, context) {
+    const workspace = resolveProtectedCandidate(context.workspacePath ?? context.projectPath);
+    const managedTempDir = context.managedTempDir
+        ? resolveProtectedCandidate(context.managedTempDir)
+        : undefined;
+    for (const candidate of applyPatchChangePaths(changes)) {
+        const resolved = path.isAbsolute(candidate)
+            ? resolveProtectedCandidate(candidate)
+            : resolveProtectedCandidate(candidate, workspace);
+        if (isSameOrDescendant(resolved, workspace))
+            continue;
+        if (managedTempDir && isSameOrDescendant(resolved, managedTempDir))
+            continue;
+        return resolved;
+    }
+    return undefined;
+}
 function requestsFilesystemRoot(value) {
     if (Array.isArray(value))
         return value.some(requestsFilesystemRoot);
@@ -1793,6 +1948,7 @@ export function checkHClassWrite(toolName, input, context) {
             : command;
         const protectedOperands = analyzeShellProtectedOperands(policyCommand, {
             cwd: context?.projectPath,
+            selfAid: context?.selfAid,
             root: context?.root,
             managedTempDir: context?.managedTempDir,
             allowProtectedMetadata: context?.allowProtectedMetadata,
@@ -1830,7 +1986,7 @@ export function checkHClassWrite(toolName, input, context) {
     // *.json_ backup indistinguishable from an actual file access. Any nested
     // filesystem operation is checked again when it reaches Read/Write/Bash,
     // FileChange, or PermissionGrant above.
-    const pathOptions = { cwd: context?.projectPath, root: context?.root };
+    const pathOptions = { cwd: context?.projectPath, root: context?.root, selfAid: context?.selfAid };
     if (['Read', 'Glob', 'Grep'].includes(toolName)) {
         const matchedReadPath = protectedReadToolMatchesHClass(toolName, input, pathOptions);
         if (matchedReadPath) {
@@ -1854,7 +2010,8 @@ export function checkHClassWrite(toolName, input, context) {
     for (const grantPath of grantPaths) {
         if (!grantPath)
             continue;
-        if (containsHClassReference(grantPath) || hClassGrantIncludesProtectedPath(grantPath, pathOptions)) {
+        if (containsHClassReference(grantPath, pathOptions) || containsAgentScopeReference(grantPath, pathOptions)
+            || hClassGrantIncludesProtectedPath(grantPath, pathOptions)) {
             logger.warn(`[H-Class Protection] 🔒 Permission grant covers protected paths: tool=${toolName} path=${grantPath} ` +
                 `session=${context?.sessionId} channel=${context?.channel} peer=${context?.peerId} role=${context?.role}`);
             return {
@@ -1877,7 +2034,8 @@ export function checkHClassWrite(toolName, input, context) {
         const candidate = path.isAbsolute(subpath)
             ? subpath
             : path.resolve(permissionWorkspace, subpath);
-        if (containsHClassReference(subpath) || hClassGrantIncludesProtectedPath(candidate, { root: context?.root })) {
+        if (containsHClassReference(subpath, pathOptions) || containsAgentScopeReference(subpath, pathOptions)
+            || hClassGrantIncludesProtectedPath(candidate, pathOptions)) {
             logger.warn(`[H-Class Protection] 🔒 project_roots grant covers protected paths: tool=${toolName} path=${subpath} ` +
                 `workspace=${permissionWorkspace} session=${context?.sessionId} channel=${context?.channel} ` +
                 `peer=${context?.peerId} role=${context?.role}`);
@@ -1890,7 +2048,9 @@ export function checkHClassWrite(toolName, input, context) {
     }
     for (const filePath of paths) {
         const normalized = filePath.replace(/\\/g, '/');
-        const matched = containsHClassReference(normalized) || isHClassPath(filePath, pathOptions);
+        const matched = containsHClassReference(normalized, pathOptions)
+            || containsAgentScopeReference(normalized, pathOptions)
+            || isHClassPath(filePath, pathOptions);
         if (matched) {
             const fileBasename = path.basename(filePath);
             logger.warn(`[H-Class Protection] 🔒 Protected file access blocked: tool=${toolName} path=${filePath} ` +
@@ -1932,7 +2092,7 @@ export function checkHClassWrite(toolName, input, context) {
  */
 export function checkLClassWrite(toolName, input, context) {
     if (['Read', 'Glob', 'Grep'].includes(toolName)) {
-        const pathOptions = { cwd: context?.projectPath, root: context?.root };
+        const pathOptions = { cwd: context?.projectPath, root: context?.root, selfAid: context?.selfAid };
         const lClassRead = protectedReadToolMatchesLClass(toolName, input, pathOptions);
         if (lClassRead && context?.permissionMode === 'readonly') {
             return { behavior: 'deny', message: '🔒 只读模式：visitor 最低权限不允许读取 L-class 路径', matchedPath: lClassRead };
@@ -1961,7 +2121,7 @@ export function checkLClassWrite(toolName, input, context) {
     }
     else if (toolName === 'Bash') {
         const command = typeof input.command === 'string' ? input.command : '';
-        const pathOptions = { cwd: context?.projectPath, root: context?.root };
+        const pathOptions = { cwd: context?.projectPath, root: context?.root, selfAid: context?.selfAid };
         const protectedOperands = analyzeShellProtectedOperands(command, {
             ...pathOptions,
             managedTempDir: context?.managedTempDir,
@@ -1991,7 +2151,7 @@ export function checkLClassWrite(toolName, input, context) {
     // Do not infer mutation targets from arbitrary orchestration-tool strings.
     // Skills commonly pass args: "" and delegation prompts may discuss
     // protected paths; neither is itself a filesystem mutation.
-    const pathOptions = { cwd: context?.projectPath, root: context?.root };
+    const pathOptions = { cwd: context?.projectPath, root: context?.root, selfAid: context?.selfAid };
     for (const grantPath of writeGrantPaths) {
         if (grantPath && lClassGrantIncludesProtectedPath(grantPath, pathOptions)) {
             logger.warn(`[L-Class Protection] Write grant covers protected paths: tool=${toolName} path=${grantPath}`);
@@ -2008,7 +2168,7 @@ export function checkLClassWrite(toolName, input, context) {
             return { behavior: 'deny', message: '🔒 无法确定 L-class 写权限的 thread workspace，已拒绝授权' };
         }
         const candidate = path.isAbsolute(subpath) ? subpath : path.resolve(permissionWorkspace, subpath);
-        if (lClassGrantIncludesProtectedPath(candidate, { root: context?.root })) {
+        if (lClassGrantIncludesProtectedPath(candidate, { root: context?.root, selfAid: context?.selfAid })) {
             return { behavior: 'deny', message: '🔒 请求的 project_roots 写权限包含 L-class 只读路径，已拒绝授权' };
         }
     }
@@ -2053,6 +2213,7 @@ export function checkBlacklist(toolName, input) {
 function managedTempOptions(context) {
     return {
         cwd: context.projectPath,
+        workspacePath: context.workspacePath ?? context.projectPath,
         // A managed session must never inherit the daemon's unrelated TMPDIR.
         env: context.sessionId
             ? { ...process.env, TMPDIR: context.managedTempDir ?? '' }
@@ -2061,6 +2222,28 @@ function managedTempOptions(context) {
                 : process.env,
     };
 }
+/**
+ * 校验 `cd <dir> && ec ...` 白名单里的目录。
+ *
+ * 白名单放宽的是"前缀拼接"这一层，目录本身的可见范围不能跟着放大：它必须
+ * 落在当前项目（或 workspace）之内。目录是字面量、已经过词法层过滤（不含
+ * 变量展开/通配），这里只需做包含性判断，禁用相对路径逃逸与绝对路径出界。
+ */
+function validateCdPrefixedCwd(cwd, context) {
+    // 零副作用前缀（pwd/echo）不带目录，无需校验。
+    if (!cwd)
+        return undefined;
+    const projectRoot = resolveProtectedCandidate(context.projectPath);
+    const workspaceRoot = resolveProtectedCandidate(context.workspacePath ?? context.projectPath);
+    // 相对路径按项目根解析——与 shell 里 cd 的语义一致（runner 的起始目录）。
+    const resolved = path.isAbsolute(cwd)
+        ? resolveProtectedCandidate(cwd)
+        : resolveProtectedCandidate(path.resolve(projectRoot, cwd));
+    if (!isSameOrDescendant(resolved, projectRoot) && !isSameOrDescendant(resolved, workspaceRoot)) {
+        return '🔒 `cd <目录> && ec ...` 的目录必须位于当前项目范围内；如需其它目录请直接调用 `ec ...`，不要拼接 `cd`。';
+    }
+    return undefined;
+}
 function validateBoundedOutputPath(command, context) {
     const outputPath = command.outputPath;
     if (!outputPath)
@@ -2140,14 +2323,18 @@ function prepareBoundedOutputInput(input, command, kind, context) {
         return { behavior: 'deny', input, message: '🔒 安全输出 helper 不可用，命令已拒绝', policyCode: 'bounded_output_helper_unavailable' };
     }
     const payload = Buffer.from(JSON.stringify({
-        v: 1,
+        // v3 carries a chain of stdin-only filters; v1 named only the filter's
+        // arguments and v2 carried a single filter argv, so both are rejected
+        // rather than misread.
+        v: 3,
         nonce: randomUUID(),
         kind,
         workspace: path.resolve(context.workspacePath ?? context.projectPath),
-        cwd: path.resolve(context.projectPath),
+        cwd: command.cwd ? path.resolve(command.cwd) : path.resolve(context.projectPath),
         argv: command.argv,
         mergeStderr: command.mergeStderr,
-        ...(command.headArgs ? { headArgs: command.headArgs } : {}),
+        ...(command.filterChain?.length ? { filterChain: command.filterChain } : {}),
+        ...(command.suffixArgv?.length ? { suffixArgv: command.suffixArgv } : {}),
         ...(command.outputPath
             ? { outputPath: expandManagedTempPath(command.outputPath, managedTempOptions(context)) }
             : {}),
@@ -2161,6 +2348,18 @@ function prepareBoundedOutputInput(input, command, kind, context) {
 }
 /** Shared fail-closed preflight used before runner-specific mode and approval handling. */
 export function evaluateToolPreflight(toolName, input, context) {
+    let applyPatchFileChanges;
+    const managedPathCheck = checkManagedTempToolPaths(toolName, input, managedTempOptions(context));
+    if (managedPathCheck.kind === 'deny') {
+        const currentTmpDir = resolveManagedTempDir(managedTempOptions(context).env);
+        return {
+            behavior: 'deny',
+            input,
+            message: `🔒 临时文件必须位于当前会话的 $TMPDIR 内（当前值：${currentTmpDir ?? '<不可用>'}）：${managedPathCheck.reason}`,
+            policyCode: 'temporary_path_outside_tmpdir',
+            matchedPath: managedPathCheck.paths[0],
+        };
+    }
     if (toolName === 'Bash') {
         const command = typeof input.command === 'string' ? input.command : '';
         const explicitCommandArgv = Array.isArray(input.commandArgv)
@@ -2215,6 +2414,41 @@ export function evaluateToolPreflight(toolName, input, context) {
                 : {}),
         };
         const parsedCodex = context.sessionId ? parseCodexToolCommand(input, parserOptions) : null;
+        const applyPatch = parseShellApplyPatchInvocation(input, parserOptions, parsedCodex?.ok ? parsedCodex.argv : undefined);
+        if (applyPatch.kind === 'invalid') {
+            return {
+                behavior: 'deny',
+                input,
+                message: '文件修改 patch 无法安全解析：' + applyPatch.reason,
+                policyCode: 'apply_patch_unparseable',
+                errorDetailCode: 'APPLY_PATCH_UNPARSEABLE',
+            };
+        }
+        if (applyPatch.kind === 'file-change') {
+            applyPatchFileChanges = applyPatch.fileChanges;
+            if (context.permissionMode === 'readonly') {
+                return {
+                    behavior: 'deny',
+                    input,
+                    message: '🔒 只读模式：禁止通过 apply_patch 修改文件',
+                    policyCode: 'readonly_file_write',
+                    errorDetailCode: 'READONLY_FILE_WRITE',
+                };
+            }
+            const escapedPath = applyPatchWorkspaceEscape(applyPatch.fileChanges, context);
+            if (escapedPath && context.sessionId
+                && context.permissionMode !== 'request'
+                && context.permissionMode !== 'fullaccess') {
+                return {
+                    behavior: 'deny',
+                    input,
+                    message: '🔒 apply_patch 目标必须位于当前 workspace 或会话 $TMPDIR 内',
+                    policyCode: 'apply_patch_workspace_escape',
+                    errorDetailCode: 'APPLY_PATCH_WORKSPACE_ESCAPE',
+                    matchedPath: escapedPath,
+                };
+            }
+        }
         if (context.sessionId && parsedCodex && !parsedCodex.ok && parsedCodex.issue === 'untrusted-shell') {
             return {
                 behavior: 'deny',
@@ -2310,6 +2544,13 @@ export function evaluateToolPreflight(toolName, input, context) {
         if (ecCommand.kind === 'bounded-output') {
             return prepareBoundedOutputInput(input, ecCommand.command, 'ec', context);
         }
+        if (ecCommand.kind === 'cd-prefixed') {
+            const cwdError = validateCdPrefixedCwd(ecCommand.cwd, context);
+            if (cwdError) {
+                return { behavior: 'deny', input, message: cwdError, policyCode: 'ec_shell_composite_command' };
+            }
+            return prepareBoundedOutputInput(input, ecCommand.command, 'ec', context);
+        }
         if (ecCommand.kind === 'composite') {
             if (ecCommand.issue === 'untrusted-shell') {
                 return {
@@ -2334,7 +2575,7 @@ export function evaluateToolPreflight(toolName, input, context) {
             }
             if (ecCommand.issue === 'invalid-quote') {
                 const message = shellDialect === 'powershell'
-                    ? '🔒 EC 命令引号未闭合或存在错误嵌套；PowerShell 正文内的双引号请用反引号转义，或改用单引号包裹纯文字'
+                    ? '🔒 EC 命令引号未闭合或存在错误嵌套；PowerShell 也会解释中文弯引号。请按 PowerShell 规则转义，或把消息正文写入当前 $TMPDIR 后使用 --text-from-file'
                     : shellDialect === 'cmd'
                         ? '🔒 EC 命令引号未闭合或存在错误嵌套；cmd.exe carrier 的命令正文请保持一个完整参数，不要用未配对的双引号'
                         : '🔒 EC 命令引号未闭合或存在错误嵌套；正文中的双引号请写成 \\"';
@@ -2345,6 +2586,12 @@ export function evaluateToolPreflight(toolName, input, context) {
                     policyCode: 'ec_shell_invalid_quote',
                 };
             }
+            if (ecCommand.issue === 'unsupported-escape') {
+                return { behavior: 'deny', input, message: '🔒 EC 内联文本不支持 PowerShell `n；请使用字面量 \\n。', policyCode: 'ec_shell_unsupported_escape' };
+            }
+            if (ecCommand.issue === 'lossy-cmd-shim') {
+                return { behavior: 'deny', input, message: '🔒 PowerShell 调用 ec.cmd 会截断物理多行参数；请保持原有 ec ... 调用，由 PowerShell 原生 shim 无损传递。', policyCode: 'ec_shell_lossy_cmd_shim' };
+            }
             const message = shellDialect === 'powershell'
                 ? '🔒 EC 命令调用被拒绝：一次 PowerShell/exec_command 只能执行一条完整的 `ec` 命令。请直接调用 `ec ...`，不要拼接探测命令，也不要使用 `&&`、`||`、`;`、`|`、重定向、变量展开或子表达式追加其它命令。'
                 : shellDialect === 'cmd'
@@ -2375,11 +2622,16 @@ export function evaluateToolPreflight(toolName, input, context) {
         return { behavior: 'deny', input, message: blacklist.message, policyCode: 'tool_blacklist' };
     }
     const checkedInput = blacklist.updatedInput;
-    const hClass = checkHClassWrite(toolName, checkedInput, {
+    const policyInput = applyPatchFileChanges
+        ? { ...checkedInput, fileChanges: applyPatchFileChanges }
+        : checkedInput;
+    const policyToolName = applyPatchFileChanges ? 'FileChange' : toolName;
+    const hClass = checkHClassWrite(policyToolName, policyInput, {
         sessionId: context.sessionId,
         channel: context.channel,
         peerId: context.userId,
         role: context.role,
+        selfAid: context.selfAid,
         projectPath: context.projectPath,
         workspacePath: context.workspacePath,
         root: context.root,
@@ -2391,11 +2643,12 @@ export function evaluateToolPreflight(toolName, input, context) {
     if (hClass.behavior === 'deny') {
         return { behavior: 'deny', input: checkedInput, message: hClass.message, policyCode: 'h_class_protection', matchedPath: hClass.matchedPath };
     }
-    const lClass = checkLClassWrite(toolName, checkedInput, {
+    const lClass = checkLClassWrite(policyToolName, policyInput, {
         sessionId: context.sessionId,
         channel: context.channel,
         peerId: context.userId,
         role: context.role,
+        selfAid: context.selfAid,
         permissionMode: context.permissionMode,
         projectPath: context.projectPath,
         workspacePath: context.workspacePath,

package/dist/core/role/runtime-policy.js

@@ -2,7 +2,7 @@ import { getRoleDefinition } from '../../config/roles.js';
 import { PUBLIC_PERMISSION_MODES } from '../permission/mode.js';
 import { ConfigTarget, read } from '../../config/config-manager.js';
 import { resolvePrincipal } from '../../config/contact-book.js';
-import { isFullAccessEnabled, loadDaemonConfig } from '../../config-store.js';
+import { loadDaemonConfig } from '../../config-store.js';
 import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
 const PERMISSION_MODE_AUTHORITY = {
     readonly: 0,
@@ -145,17 +145,16 @@ export function validateRuntimeStringFieldOverride(input) {
 }
 /**
  * Resolve the Agent-level host execution policy for one authenticated principal.
- * The Agent flag is subordinate to daemon fullaccess and independent of role permissionMode values.
+ * The Agent flag is independent of role permissionMode values.
  */
 export function agentFullAccessStatus(agentAid, principalId) {
     const config = read(ConfigTarget.Agent, { self: agentAid }, { cache: false });
     const daemon = loadDaemonConfig();
     const enabled = config?.fullaccess?.enabled === true;
-    const hostEnabled = isFullAccessEnabled(daemon);
     const eligible = !!principalId
         && !!config?.owners?.includes(principalId)
         && !!daemon.owners?.includes(principalId);
-    return { enabled, hostEnabled, eligible, effective: enabled && hostEnabled && eligible };
+    return { enabled, eligible, effective: enabled && eligible };
 }
 /** Create a trusted per-call claim for a direct private message. */
 export function createAgentPolicyAuthorization(input) {
@@ -198,8 +197,5 @@ export function agentFullAccessWriteError(input) {
     if (!input.daemonOwner || input.delegated) {
         return 'Only authenticated ECWeb management may configure Agent fullaccess';
     }
-    if (input.enabled && !isFullAccessEnabled()) {
-        return 'Host fullaccess is disabled';
-    }
     return undefined;
 }

package/dist/core/session/{runner-task-history.js → runner-event-summary.js}

@@ -86,7 +86,7 @@ function eventTaskId(event, aliases) {
     const useId = typeof event.toolUseId === 'string' ? event.toolUseId.trim() : '';
     return useId ? aliases.get(useId) ?? `tool:${useId}` : null;
 }
-export function readRunnerTaskHistory(logsDir, evolSessionId) {
+export function readRunnerEventSummary(logsDir, evolSessionId) {
     let files;
     try {
         files = fs.readdirSync(logsDir)

package/dist/core/session/session-fs-store.js

@@ -545,82 +545,6 @@ export function scanNestedAgentChatDirs(sessionsRoot) {
     }
     return results.sort((left, right) => left.dirPath < right.dirPath ? -1 : left.dirPath > right.dirPath ? 1 : 0);
 }
-/** Scan the pre-migration data/sessions layout without changing it. */
-export function scanLegacyChatDirs(sessionsDir) {
-    const results = [];
-    let typeEntries;
-    try {
-        typeEntries = fs.readdirSync(sessionsDir, { withFileTypes: true });
-    }
-    catch {
-        return results;
-    }
-    for (const typeEntry of typeEntries) {
-        if (!typeEntry.isDirectory())
-            continue;
-        const channelType = typeEntry.name;
-        const typeDir = path.join(sessionsDir, channelType);
-        let level2Entries;
-        try {
-            level2Entries = fs.readdirSync(typeDir, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        if (channelType === 'aun') {
-            for (const selfEntry of level2Entries) {
-                if (!selfEntry.isDirectory())
-                    continue;
-                const selfDir = path.join(typeDir, selfEntry.name);
-                let chatEntries;
-                try {
-                    chatEntries = fs.readdirSync(selfDir, { withFileTypes: true });
-                }
-                catch {
-                    continue;
-                }
-                for (const chatEntry of chatEntries)
-                    if (chatEntry.isDirectory())
-                        results.push({
-                            channelType, selfAID: decodeSegment(selfEntry.name), channelId: decodeSegment(chatEntry.name), dirPath: path.join(selfDir, chatEntry.name),
-                        });
-            }
-            continue;
-        }
-        if (channelType === 'wecom') {
-            for (const entry of level2Entries) {
-                if (!entry.isDirectory())
-                    continue;
-                const decoded = decodeSegment(entry.name);
-                const entryDir = path.join(typeDir, entry.name);
-                if (decoded.startsWith('wecom#') && decoded.split('#').length === 3) {
-                    let chatEntries;
-                    try {
-                        chatEntries = fs.readdirSync(entryDir, { withFileTypes: true });
-                    }
-                    catch {
-                        continue;
-                    }
-                    for (const chatEntry of chatEntries)
-                        if (chatEntry.isDirectory())
-                            results.push({
-                                channelType, selfAID: '', channelKey: decoded, channelId: decodeSegment(chatEntry.name), dirPath: path.join(entryDir, chatEntry.name),
-                            });
-                }
-                else {
-                    results.push({ channelType, selfAID: '', channelId: decoded, dirPath: entryDir });
-                }
-            }
-            continue;
-        }
-        for (const chatEntry of level2Entries)
-            if (chatEntry.isDirectory())
-                results.push({
-                    channelType, selfAID: '', channelId: decodeSegment(chatEntry.name), dirPath: path.join(typeDir, chatEntry.name),
-                });
-    }
-    return results.sort((left, right) => left.dirPath < right.dirPath ? -1 : left.dirPath > right.dirPath ? 1 : 0);
-}
 export function scanMetaFiles(chatDir) {
     try {
         const entries = fs.readdirSync(chatDir);