evolcore 0.0.28 → 0.0.29-test.0

package/dist/core/permission/sandbox-runtime.js

@@ -1,8 +1,8 @@
 import fs from 'fs';
 import path from 'path';
 import { resolveCommandPath } from '../../utils/cross-platform.js';
-import { getExistingHClassMaskTargets, getExistingLClassReadOnlyTargets, isSameOrDescendant, } from './protected-paths.js';
-import { resolveRoot } from '../../paths.js';
+import { getExistingHClassMaskTargets, getExistingRelationAttachmentDirs, getExistingLClassReadOnlyTargets, isSameOrDescendant, } from './protected-paths.js';
+import { resolveInstanceSocketPath, resolveRoot } from '../../paths.js';
 let cachedBubblewrapPath;
 let sandboxInitializationCircuit;
 const sessionSandboxInitializationCircuits = new Map();
@@ -387,7 +387,7 @@ function snapshotSandboxPath(candidate) {
     }
 }
 /** Capture the host-side state used to construct an H-class guard. */
-export function collectSandboxGuardDiagnostics(root = resolveRoot()) {
+export function collectSandboxGuardDiagnostics(root = resolveRoot(), options = {}) {
     const absoluteRoot = path.resolve(root);
     const candidates = [
         path.join(absoluteRoot, 'data', 'causation-aun.json'),
@@ -396,7 +396,7 @@ export function collectSandboxGuardDiagnostics(root = resolveRoot()) {
     ];
     let targets = [];
     try {
-        targets = getExistingHClassMaskTargets(absoluteRoot).map(target => target.path);
+        targets = getExistingHClassMaskTargets(absoluteRoot, options).map(target => target.path);
     }
     catch { }
     // Keep the causation file and its atomic-write sidecars first. The full H
@@ -512,13 +512,19 @@ function appendContainerEtcFileBinds(args) {
         args.push('--ro-bind', candidate, candidate);
     }
 }
-function appendHClassMasks(args, root, maskContainerSockets) {
-    for (const target of getExistingHClassMaskTargets(root)) {
+function appendHClassMasks(args, root, maskContainerSockets, options = {}) {
+    for (const target of getExistingHClassMaskTargets(root, options)) {
         if (target.kind === 'directory')
             pushMaskedDirectory(args, target.path);
         else
             pushMaskedFile(args, target.path);
     }
+    // Relation attachments are protected by per-thread Codex ACLs. Do not mask
+    // their directories at the outer bind layer, otherwise an exact authorized
+    // image read cannot be re-exposed by the inner profile.
+    for (const directory of getExistingRelationAttachmentDirs(root, options)) {
+        args.push('--ro-bind', directory, directory);
+    }
     if (!maskContainerSockets)
         return;
     // bubblewrap cannot replace an existing Unix socket with a regular-file bind
@@ -527,8 +533,28 @@ function appendHClassMasks(args, root, maskContainerSockets) {
     pushMaskedDirectory(args, '/run');
     appendRuntimeBackedEtcFiles(args);
 }
-function appendLClassReadOnlyBinds(args, root) {
-    for (const target of getExistingLClassReadOnlyTargets(root)) {
+/** Re-expose only the daemon IPC endpoint after masking the runtime data tree. */
+function appendDaemonIpcSocket(args, root) {
+    if (process.platform !== 'linux')
+        return;
+    const socketPath = resolveInstanceSocketPath(root);
+    let stat;
+    try {
+        stat = fs.lstatSync(socketPath);
+    }
+    catch {
+        return;
+    }
+    if (!stat.isSocket())
+        return;
+    const dataDir = path.join(root, 'data');
+    if (isSameOrDescendant(socketPath, dataDir)) {
+        args.push('--dir', path.dirname(socketPath));
+    }
+    args.push('--ro-bind', socketPath, socketPath);
+}
+function appendLClassReadOnlyBinds(args, root, options = {}) {
+    for (const target of getExistingLClassReadOnlyTargets(root, options)) {
         args.push('--ro-bind', target.path, target.path);
     }
 }
@@ -587,8 +613,9 @@ export function buildHClassGuardCommand(executable, executableArgs, root = resol
         '--proc', '/proc',
     ];
     if (options.protectEvolcoreFilesystem !== false) {
-        appendLClassReadOnlyBinds(args, path.resolve(root));
-        appendHClassMasks(args, path.resolve(root), true);
+        appendLClassReadOnlyBinds(args, path.resolve(root), options);
+        appendHClassMasks(args, path.resolve(root), true, options);
+        appendDaemonIpcSocket(args, path.resolve(root));
     }
     if (options.managedCodexRequirements) {
         const requirements = path.resolve(options.managedCodexRequirements);
@@ -644,8 +671,9 @@ export function buildBubblewrapCommand(executable, executableArgs, options) {
             continue;
         args.push('--ro-bind', resolved, resolved);
     }
-    appendLClassReadOnlyBinds(args, root);
-    appendHClassMasks(args, root, true);
+    appendLClassReadOnlyBinds(args, root, options);
+    appendHClassMasks(args, root, true, options);
+    appendDaemonIpcSocket(args, root);
     args.push('--chdir', projectPath, '--', executable, ...executableArgs);
     return { command: bubblewrapPath, args };
 }

package/dist/core/permission/tool-error-code.js

@@ -1,3 +1,18 @@
+const PERMISSION_ERROR_CODES = new Set([
+    'POLICY_DENIED',
+    'ROLE_DENIED',
+    'USER_DENIED',
+    'APPROVAL_TIMEOUT',
+    'DELEGATION_FAILED',
+]);
+const DETAIL_CODE_BY_POLICY_CODE = {
+    native_file_change_required: 'NATIVE_FILE_CHANGE_REQUIRED',
+    apply_patch_unparseable: 'APPLY_PATCH_UNPARSEABLE',
+    apply_patch_workspace_escape: 'APPLY_PATCH_WORKSPACE_ESCAPE',
+    ec_shell_invalid_quote: 'INVALID_QUOTE',
+    ec_command_not_canonical: 'INVALID_ARGUMENT',
+    patch_context_mismatch: 'PATCH_CONTEXT_MISMATCH',
+};
 export function normalizeToolErrorCode(value) {
     if (typeof value !== 'string')
         return undefined;
@@ -10,27 +25,95 @@ export function normalizeToolErrorCode(value) {
         return code;
     return undefined;
 }
-export function classifyToolErrorCode(input) {
-    const explicit = normalizeToolErrorCode(input.errorCode);
+export function normalizeToolErrorDetailCode(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const code = value.trim().toUpperCase().replace(/[ .-]+/g, '_');
+    return /^[A-Z][A-Z0-9_]{1,127}$/u.test(code) ? code : undefined;
+}
+function executionFacts(input) {
+    const executed = typeof input.executed === 'boolean' ? input.executed : undefined;
+    const executionState = typeof input.executionState === 'string'
+        ? input.executionState.trim().toLowerCase()
+        : undefined;
+    const exitCode = typeof input.exitCode === 'number' && Number.isInteger(input.exitCode)
+        ? input.exitCode
+        : undefined;
+    const started = executed === true || executionState === 'completed' || executionState === 'failed' || exitCode !== undefined;
+    const blocked = executed === false && executionState === 'blocked';
+    const conflict = (executed === true && executionState === 'blocked')
+        || (executed === false && (executionState === 'completed' || executionState === 'failed'))
+        || (exitCode !== undefined && executed === false);
+    return { executed, executionState, exitCode, started, blocked, conflict };
+}
+function detailCodeForInput(input) {
+    const explicit = normalizeToolErrorDetailCode(input.errorDetailCode ?? input.detailCode);
     if (explicit)
         return explicit;
-    if (input.decisionSource === 'policy')
-        return 'POLICY_DENIED';
-    if (input.decisionSource === 'approval')
-        return 'USER_DENIED';
-    return 'EXECUTION_FAILED';
+    if (typeof input.policyCode === 'string') {
+        return DETAIL_CODE_BY_POLICY_CODE[input.policyCode.trim().toLowerCase()];
+    }
+    return undefined;
+}
+/**
+ * Normalize one tool failure from structured execution facts.
+ *
+ * Permission errors are emitted only when the operation is explicitly known
+ * to have been blocked before execution. Plain `decisionSource=policy` is not
+ * enough: providers frequently reuse that field while reporting a process
+ * that already started and then failed.
+ */
+export function normalizeToolErrorClassification(input) {
+    const explicit = normalizeToolErrorCode(input.errorCode);
+    const hadErrorCode = input.errorCode !== undefined && input.errorCode !== null;
+    const facts = executionFacts(input);
+    const decisionSource = typeof input.decisionSource === 'string'
+        ? input.decisionSource.trim().toLowerCase()
+        : undefined;
+    const explicitPermission = explicit !== undefined && PERMISSION_ERROR_CODES.has(explicit);
+    const hasPermissionSource = decisionSource === 'policy' || decisionSource === 'approval';
+    const exactPermissionBlock = facts.blocked && (hasPermissionSource || explicitPermission);
+    let classificationConflict = facts.conflict;
+    if (hasPermissionSource && facts.started)
+        classificationConflict = true;
+    if (explicitPermission && facts.started)
+        classificationConflict = true;
+    let errorCode;
+    if (explicitPermission) {
+        errorCode = exactPermissionBlock && !facts.started
+            ? explicit
+            : 'EXECUTION_FAILED';
+    }
+    else if (explicit) {
+        errorCode = explicit;
+    }
+    else if (exactPermissionBlock) {
+        errorCode = decisionSource === 'approval' ? 'USER_DENIED' : 'POLICY_DENIED';
+    }
+    else {
+        errorCode = 'EXECUTION_FAILED';
+    }
+    const classificationMissing = (!explicit && !exactPermissionBlock)
+        || (hadErrorCode && !explicit);
+    const errorDetailCode = detailCodeForInput(input)
+        ?? (facts.exitCode !== undefined && facts.exitCode !== 0 ? 'PROCESS_EXIT_NONZERO' : undefined);
+    return {
+        errorCode,
+        ...(errorDetailCode ? { errorDetailCode } : {}),
+        ...(classificationMissing ? { classificationMissing: true } : {}),
+        ...(classificationConflict ? { classificationConflict: true } : {}),
+    };
+}
+export function classifyToolErrorCode(input) {
+    return normalizeToolErrorClassification(input).errorCode;
 }
 /**
  * Map the internal error taxonomy to the intentionally small AUN activity
  * contract. The detailed code remains available to local audit consumers.
  */
 export function classifyAunToolErrorCode(input) {
-    const code = classifyToolErrorCode(input);
-    if (code === 'POLICY_DENIED'
-        || code === 'ROLE_DENIED'
-        || code === 'USER_DENIED'
-        || code === 'APPROVAL_TIMEOUT'
-        || code === 'DELEGATION_FAILED') {
+    const code = normalizeToolErrorClassification(input).errorCode;
+    if (PERMISSION_ERROR_CODES.has(code)) {
         return 'PERMISSION_DENIED';
     }
     return 'EXECUTION_FAILED';