evolcore 0.0.28 → 0.0.29

package/dist/core/permission/protected-paths.js

@@ -1,68 +1,55 @@
 import fs from 'fs';
 import path from 'path';
 import { resolveRoot } from '../../paths.js';
+import { isValidAid } from '../../aun/aid/identity.js';
 const H_CLASS_RELATIVE_PATTERNS = [
-    /^daemon\.json$/,
-    /^agents\/defaults\.json$/,
-    /^agents\/[^/]+\/config\.json$/,
-    /^agents\/[^/]+\/contact\.json$/,
-    /^agents\/[^/]+\/contact-operations\.jsonl$/,
-    /^agents\/[^/]+\/relations\/[^/]+\/config\.json$/,
-    /^backups\/config(?:\/|$)/,
+    // These are true secret or daemon-owned roots. Agent-owned content is not
+    // H-class merely because it is persisted under the EvolCore home.
+    /^data(?:\/|$)/,
+    /^(?:AIDs|aids)(?:\/|$)/,
     /^\.snapshots(?:\/|$)/,
     /^CA(?:\/|$)/,
-    /^(?:AIDs|aids)\/[^/]+\/(?:cert|keys|private)(?:\/|$)/,
     /^\.device_id$/,
     /^\.env$/,
     /^\.seed(?:\.|$)/,
     /^\.migrated-/,
-    /(?:^|\/)[^/]+\.json_$/,
-    /(?:^|\/)[^/]+\.json\.migrated$/,
-    /^agents\/defaults_\d+\.json$/,
     /^\.lock$/,
     /^daemon\.pid$/,
-    /^data\/causation-aun\.json(?:_|__)?$/,
-    /^data\/triggers(?:\/|$)/,
-    /^data\/(?:sessions(?:\/|$)|contact-book-audit\.jsonl$|feishu-seen-.*\.jsonl$|[a-z0-9_-]+-greeted-.*\.jsonl$|message-queue\.json(?:_|__|\.tmp-.*)?$|daemon\/(?:message-queue\.json(?:_|__|\.tmp-.*)?$|control(?:\/|$)|migrations(?:\/|$))|channel-state(?:\/|$))/,
-    /^data\/instance\/control\.token$/,
-    /^data\/outbox(?:\/|$)/,
-    /^data\/handoff(?:\/|$)/,
-    /^agents\/[^/]+\/sessions(?:\/|$)/,
-    /^agents\/[^/]+\/data\/async-questions(?:\/|$)/,
-    /^agents\/[^/]+\/data\/aun(?:\/|$)/,
-    /^agents\/[^/]+\/data\/(?:channels(?:\/|$)|handoff(?:\/|$)|(?:outbox|activity-outbox)\.jsonl(?:_|__|\.tmp-.*)?$|contact-audit\.jsonl$)/,
+    /^agents\/[^/]+\/data\/codex-tokens(?:\/|$)/,
+    /^agents\/[^/]+\/data\/(?:.*\/)?(?:context-tokens|menu-tokens)\.json(?:_|__|\.tmp-.*)?$/,
 ];
 const H_CLASS_REFERENCE_PATTERNS = [
-    /(?:^|[/\\\s"'=<>])agents[\\/][^/\\\s"']+[\\/]data[\\/]async-questions(?:[\\/]|$|[\s"';&|<>)},])/,
-    /(?:^|[/\\\s"'=<>])agents[\\/][^/\\\s"']+[\\/]data[\\/]aun(?:[\\/]|$|[\s"';&|<>)},])/,
-    /(?:^|[^A-Za-z0-9_.-])daemon\.json(?=$|[^A-Za-z0-9_.-])/,
-    /(?:^|[^A-Za-z0-9_.-])agents[\\/](?:defaults\.json|[^/\\\s"']+[\\/](?:(?:config|contact)\.json|contact-operations\.jsonl|relations[\\/][^/\\\s"']+[\\/]config\.json))(?=$|[\s"';&|<>)},])/,
-    /(?:^|[^A-Za-z0-9_.-])(?:backups[\\/]config|\.snapshots|CA|(?:AIDs|aids)[\\/][^/\\\s"']+[\\/](?:cert|keys|private))(?:[\\/]|$|[\s"';&|<>)},])/,
-    /(?:^|[/\\\s"'=<>])(?:\.device_id|\.env|\.seed(?:\.[^/\\\s"']*)?|\.migrated-[^/\\\s"']*|\.lock|daemon\.pid|data[\\/](?:causation-aun\.json(?:_|__)?|sessions|contact-book-audit\.jsonl|feishu-seen-[^/\\\s"']+\.jsonl|[a-z0-9_-]+-greeted-[^/\\\s"']+\.jsonl|message-queue\.json(?:_|__|\.tmp-[^/\\\s"']*)?|daemon[\\/](?:message-queue\.json(?:_|__|\.tmp-[^/\\\s"']*)?|control|migrations)|channel-state|instance[\\/]control\.token|outbox|handoff)|agents[\\/][^/\\\s"']+[\\/](?:sessions|data[\\/](?:channels|handoff|(?:outbox|activity-outbox)\.jsonl|contact-audit\.jsonl)))(?:[\\/]|$|[\s"';&|<>)},])/,
-    /(?:^|[/\\\s"'=<>])data[\\/]triggers(?:[\\/]|$|[\s"';&|<>)},])/,
-    /(?:^|[/\\\s"'=<>])(?:[^/\\\s"']+\.json_|[^/\\\s"']+\.json\.migrated|defaults_\d+\.json)(?=$|[\s"';&|<>)},])/,
+    /(?:^|[/\\\s"'=<>])data[\\/]/,
+    /(?:^|[/\\\s"'=<>])(?:AIDs|aids)[\\/]/,
+    /(?:^|[^A-Za-z0-9_.-])(?:\.device_id|\.env|\.seed(?:\.[^/\\\s"']*)?|\.migrated-[^/\\\s"']*|\.lock|daemon\.pid)(?=$|[\s"';&|<>)},])/,
+    /(?:^|[/\\\s"'=<>])agents[\\/][^/\\\s"']+[\\/]data[\\/](?:codex-tokens|(?:.*[\\/])?(?:context-tokens|menu-tokens)\.json)(?:[\\/]|$|[\s"';&|<>)},])/,
 ];
 // H-class directory roots are kept separately from the full path matcher so
 // an exact metadata query can distinguish a protected directory from a
 // protected file. Descendants inherit the directory classification unless an
 // existing regular file gives us a more precise answer.
 const H_CLASS_DIRECTORY_RELATIVE_PATTERNS = [
-    /^agents\/[^/]+\/data\/aun(?:\/|$)/,
-    /^agents\/[^/]+\/data\/async-questions(?:\/|$)/,
-    /^backups\/config(?:\/|$)/,
+    /^data(?:\/|$)/,
+    /^(?:AIDs|aids)(?:\/|$)/,
     /^\.snapshots(?:\/|$)/,
     /^CA(?:\/|$)/,
-    /^(?:AIDs|aids)\/[^/]+\/(?:cert|keys|private)(?:\/|$)/,
-    /^data\/(?:triggers|sessions|outbox|handoff|channel-state)(?:\/|$)/,
-    /^data\/daemon\/(?:control|migrations)(?:\/|$)/,
-    /^agents\/[^/]+\/sessions(?:\/|$)/,
-    /^agents\/[^/]+\/data\/(?:channels|handoff)(?:\/|$)/,
+    /^agents\/[^/]+\/data\/codex-tokens(?:\/|$)/,
 ];
 const L_CLASS_RELATIVE_PATTERNS = [
+    /^daemon\.json$/,
+    /^agents\/defaults\.json$/,
+    /^agents\/[^/]+\/config\.json$/,
+    /^agents\/[^/]+\/contact\.json$/,
+    /^agents\/[^/]+\/contact-operations\.jsonl$/,
+    /^agents\/[^/]+\/relations\/[^/]+\/config\.json$/,
+    /^backups\/config(?:\/|$)/,
     /^agents\/[^/]+\/triggers(?:\/|$)/,
     /^agents\/[^/]+\/roles(?:\/|$)/,
 ];
 const L_CLASS_REFERENCE_PATTERNS = [
+    /(?:^|[^A-Za-z0-9_.-])daemon\.json(?=$|[^A-Za-z0-9_.-])/,
+    /(?:^|[^A-Za-z0-9_.-])agents[\\/](?:defaults\.json|[^/\\\s"']+[\\/](?:(?:config|contact)\.json|contact-operations\.jsonl|relations[\\/][^/\\\s"']+[\\/]config\.json))(?=$|[\s"';&|<>)},])/,
+    /(?:^|[^A-Za-z0-9_.-])backups[\\/]config(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[^A-Za-z0-9_.-])agents[\\/][^/\\\s"']+[\\/]triggers(?:[\\/]|$|[\s"';&|<>)},])/,
     /(?:^|[^A-Za-z0-9_.-])agents[\\/][^/\\\s"']+[\\/]roles(?:[\\/]|$|[\s"';&|<>)},])/,
 ];
@@ -88,6 +75,60 @@ function resolveThroughExistingAncestor(value) {
         return absolute;
     }
 }
+function hasExplicitSelfAid(options) {
+    // Several legacy helper callers construct an options object with the
+    // optional property spread from an absent runtime binding, which produces
+    // `selfAid: undefined`.  Treat that the same as an omitted property so the
+    // compatibility projection remains available.  An explicitly supplied
+    // empty/invalid string is still fail-closed below.
+    return !!options
+        && Object.prototype.hasOwnProperty.call(options, 'selfAid')
+        && options.selfAid !== undefined;
+}
+function normalizeAid(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const normalized = value.trim();
+    return normalized && isValidAid(normalized) ? normalized : undefined;
+}
+function assertValidSelfAid(options, operation) {
+    if (hasExplicitSelfAid(options) && !normalizeAid(options?.selfAid)) {
+        throw new Error(`[Permission] ${operation} requires a valid selfAid`);
+    }
+}
+function hasInvalidExplicitSelfAid(options) {
+    return hasExplicitSelfAid(options) && !normalizeAid(options?.selfAid);
+}
+function agentScopeRelative(relative, selfAid) {
+    const parts = relative.split('/').filter(Boolean);
+    if (parts[0] !== 'agents' || !parts[1])
+        return false;
+    const own = normalizeAid(selfAid);
+    if (/^defaults(?:_\d+)?\.json$/i.test(parts[1]))
+        return false;
+    // With no identity context, the legacy H-class projection is used instead
+    // of guessing which Agent is self.
+    return !!own && parts[1].toLowerCase() !== own.toLowerCase();
+}
+function matchesAgentScopeRelative(relative, selfAid) {
+    return agentScopeRelative(relative, selfAid);
+}
+function agentScopeCandidate(value, options = {}) {
+    if (!normalizeAid(options.selfAid))
+        return undefined;
+    const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());
+    const lexical = lexicalCandidate(value, options.cwd);
+    if (isSameOrDescendant(lexical, root)) {
+        const relative = path.relative(root, lexical).split(path.sep).join('/');
+        if (matchesAgentScopeRelative(relative, options.selfAid))
+            return lexical;
+    }
+    const candidate = resolveProtectedCandidate(value, options.cwd);
+    if (!isSameOrDescendant(candidate, root))
+        return undefined;
+    const relative = path.relative(root, candidate).split(path.sep).join('/');
+    return matchesAgentScopeRelative(relative, options.selfAid) ? candidate : undefined;
+}
 /**
  * H-class file names are normally leaves, but treating their descendants as
  * protected as well is important when a malformed or externally-created
@@ -104,6 +145,28 @@ function matchesHClassRelative(relative) {
     }
     return false;
 }
+const SELF_AWARE_H_CLASS_RELATIVE_PATTERNS = [
+    /^data(?:\/|$)/,
+    /^(?:AIDs|aids)(?:\/|$)/,
+    /^CA(?:\/|$)/,
+    /^\.device_id$/,
+    /^\.env$/,
+    /^\.seed(?:\.|$)/,
+    /^\.lock$/,
+    /^daemon\.pid$/,
+];
+function matchesSelfAwareHClassRelative(relative, selfAid) {
+    if (matchesAgentScopeRelative(relative, selfAid))
+        return true;
+    if (SELF_AWARE_H_CLASS_RELATIVE_PATTERNS.some(pattern => pattern.test(relative)))
+        return true;
+    const own = normalizeAid(selfAid);
+    if (!own)
+        return false;
+    const escaped = own.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`^agents/${escaped}/data/codex-tokens(?:/|$)`).test(relative)
+        || new RegExp(`^agents/${escaped}/data/(?:.*\/)?(?:context-tokens|menu-tokens)\\.json(?:_|__|\\.tmp-.*)?$`).test(relative);
+}
 export function isSameOrDescendant(candidate, parent) {
     const normalizedCandidate = normalizeForComparison(candidate);
     const normalizedParent = normalizeForComparison(parent);
@@ -119,16 +182,22 @@ export function isHClassPath(value, options = {}) {
     const lexicalCandidate = path.isAbsolute(value)
         ? path.resolve(value)
         : path.resolve(options.cwd ?? process.cwd(), value);
+    if (hasInvalidExplicitSelfAid(options))
+        return isSameOrDescendant(lexicalCandidate, root);
+    if (agentScopeCandidate(value, options))
+        return true;
     if (isSameOrDescendant(lexicalCandidate, root)) {
         const lexicalRelative = path.relative(root, lexicalCandidate).split(path.sep).join('/');
-        if (matchesHClassRelative(lexicalRelative))
+        if ((options.selfAid ? matchesSelfAwareHClassRelative(lexicalRelative, options.selfAid) : matchesHClassRelative(lexicalRelative)))
             return true;
     }
     const candidate = resolveProtectedCandidate(value, options.cwd);
     if (!isSameOrDescendant(candidate, root))
         return false;
     const relative = path.relative(root, candidate).split(path.sep).join('/');
-    return matchesHClassRelative(relative);
+    return options.selfAid
+        ? matchesSelfAwareHClassRelative(relative, options.selfAid)
+        : matchesHClassRelative(relative);
 }
 function hasPathSyntax(value) {
     return /[\0\r\n$`*?\[\]{}<>|;&]/.test(value);
@@ -166,7 +235,11 @@ export function classifyProtectedPath(value, options = {}) {
     const relative = relativeWithinRoot(candidate, root);
     if (relative === undefined)
         return 'ordinary';
-    const hMatch = matchesHClassRelative(relative);
+    if (matchesAgentScopeRelative(relative, options.selfAid))
+        return 'h-directory';
+    const hMatch = options.selfAid
+        ? matchesSelfAwareHClassRelative(relative, options.selfAid)
+        : matchesHClassRelative(relative);
     if (hMatch) {
         let directory = H_CLASS_DIRECTORY_RELATIVE_PATTERNS.some(pattern => pattern.test(relative));
         try {
@@ -205,29 +278,77 @@ export function checkProtectedPathAccess(value, accessKind, options = {}) {
         allowed: accessKind !== 'write' && accessKind !== 'grant',
     };
 }
-export function containsHClassReference(value) {
+export function isAgentScopePath(value, options = {}) {
+    return !!agentScopeCandidate(value, options);
+}
+export function containsAgentScopeReference(value, options = {}) {
+    if (hasInvalidExplicitSelfAid(options))
+        return true;
+    if (!normalizeAid(options.selfAid))
+        return false;
+    const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());
+    return extractLiteralPathCandidates(value).some(candidate => isAgentScopePath(candidate, { ...options, root }));
+}
+export function containsHClassReference(value, options = {}) {
+    if (hasInvalidExplicitSelfAid(options))
+        return true;
     const normalized = value.replace(/\\/g, '/');
     const unquoted = normalized.replace(/^["']|["']$/g, '').replace(/[;,) ]+$/, '');
+    // Resolve literal paths before applying textual rules.  A self-Agent path
+    // such as agents/<self>/data/outbox/... contains the shared `data/` token,
+    // but it is ordinary Agent-owned data and must not inherit data/** H-class.
+    const literalCandidates = extractLiteralPathCandidates(value);
+    if (literalCandidates.length) {
+        const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());
+        const inRoot = literalCandidates.filter(candidate => {
+            const resolved = resolveProtectedCandidate(candidate, options.cwd);
+            return isSameOrDescendant(resolved, root);
+        });
+        if (inRoot.length) {
+            return inRoot.some(candidate => isHClassPath(candidate, options) || isAgentScopePath(candidate, options));
+        }
+    }
     if (H_CLASS_RELATIVE_PATTERNS.some(pattern => pattern.test(unquoted)))
         return true;
-    return H_CLASS_REFERENCE_PATTERNS.some(pattern => pattern.test(normalized));
+    return H_CLASS_REFERENCE_PATTERNS.some(pattern => pattern.test(normalized))
+        || containsAgentScopeReference(value, options);
+}
+function extractLiteralPathCandidates(value) {
+    const normalized = value.replace(/\\/g, '/');
+    const candidates = new Set();
+    const absolute = normalized.match(/(?:[A-Za-z]:\/|\/)[^\s"'`;|&<>()[\]{}]+/g) ?? [];
+    for (const candidate of absolute)
+        candidates.add(candidate.replace(/[.,:]+$/, ''));
+    const relative = normalized.match(/(?:^|[\s"'=<>:(])((?:\.{0,2}\/)?(?:agents|data|AIDs|aids|backups|CA|\.snapshots)(?:\/[^\s"'`;|&<>()[\]{}]*)?)/gi) ?? [];
+    for (const candidate of relative)
+        candidates.add(candidate.replace(/^[\s"'=<>:(]+/, '').replace(/[.,:]+$/, ''));
+    for (const candidate of normalized.split(/[\s"'=<>:();|&]+/).filter(Boolean)) {
+        if (/^(?:daemon\.json|\.device_id|\.env|\.seed(?:\.[^/]+)?|\.lock|daemon\.pid)$/i.test(candidate)) {
+            candidates.add(candidate);
+        }
+    }
+    return [...candidates];
 }
 /** L-class paths are readable by agents but may only be mutated by trusted daemon paths. */
 export function isLClassPath(value, options = {}) {
+    if (hasInvalidExplicitSelfAid(options))
+        return false;
     const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());
     const lexicalCandidate = path.isAbsolute(value)
         ? path.resolve(value)
         : path.resolve(options.cwd ?? process.cwd(), value);
     if (isSameOrDescendant(lexicalCandidate, root)) {
         const lexicalRelative = path.relative(root, lexicalCandidate).split(path.sep).join('/');
-        if (L_CLASS_RELATIVE_PATTERNS.some(pattern => pattern.test(lexicalRelative)))
+        if (!matchesAgentScopeRelative(lexicalRelative, options.selfAid)
+            && L_CLASS_RELATIVE_PATTERNS.some(pattern => pattern.test(lexicalRelative)))
             return true;
     }
     const candidate = resolveProtectedCandidate(value, options.cwd);
     if (!isSameOrDescendant(candidate, root))
         return false;
     const relative = path.relative(root, candidate).split(path.sep).join('/');
-    return L_CLASS_RELATIVE_PATTERNS.some(pattern => pattern.test(relative));
+    return !matchesAgentScopeRelative(relative, options.selfAid)
+        && L_CLASS_RELATIVE_PATTERNS.some(pattern => pattern.test(relative));
 }
 export function containsLClassReference(value) {
     const normalized = value.replace(/\\/g, '/');
@@ -236,8 +357,7 @@ export function containsLClassReference(value) {
         return true;
     return L_CLASS_REFERENCE_PATTERNS.some(pattern => pattern.test(normalized));
 }
-export function getHClassSandboxPatterns(root = resolveRoot()) {
-    const absoluteRoot = resolveThroughExistingAncestor(root);
+function getLegacyHClassSandboxPatterns(root) {
     const entries = [
         'daemon.json',
         path.join('agents', 'defaults.json'),
@@ -245,59 +365,60 @@ export function getHClassSandboxPatterns(root = resolveRoot()) {
         path.join('agents', '*', 'contact.json'),
         path.join('agents', '*', 'contact-operations.jsonl'),
         path.join('agents', '*', 'relations', '*', 'config.json'),
-        path.join('backups', 'config'),
-        path.join('backups', 'config', '**'),
-        '.snapshots',
-        path.join('.snapshots', '**'),
+        path.join('backups', 'config'), path.join('backups', 'config', '**'),
+        '.snapshots', path.join('.snapshots', '**'),
+        'CA', path.join('CA', '**'),
+        path.join('AIDs', '*', 'cert'), path.join('AIDs', '*', 'cert', '**'),
+        path.join('AIDs', '*', 'keys'), path.join('AIDs', '*', 'keys', '**'),
+        path.join('AIDs', '*', 'private'), path.join('AIDs', '*', 'private', '**'),
+        path.join('aids', '*', 'cert'), path.join('aids', '*', 'cert', '**'),
+        path.join('aids', '*', 'keys'), path.join('aids', '*', 'keys', '**'),
+        path.join('aids', '*', 'private'), path.join('aids', '*', 'private', '**'),
+        '.device_id', '.env', '.seed', '.seed.*', '.migrated-*',
+        path.join('**', '*.json_'), path.join('**', '*.json.migrated'),
+        path.join('agents', 'defaults_*.json'), '.lock', 'daemon.pid',
+        path.join('data', 'causation-aun.json*'), path.join('data', 'contact-book-audit.jsonl'),
+        path.join('data', 'feishu-seen-*.jsonl'), path.join('data', '*-greeted-*.jsonl'),
+        path.join('data', 'message-queue.json*'), path.join('data', 'daemon', 'message-queue.json*'),
+        path.join('data', 'daemon', 'control') + '/**', path.join('data', 'daemon', 'migrations') + '/**',
+        path.join('data', 'channel-state') + '/**', path.join('data', 'instance', 'control.token'),
+        path.join('data', 'outbox'), path.join('data', 'outbox') + '/**',
+        path.join('data', 'handoff'), path.join('data', 'handoff') + '/**',
+        path.join('agents', '*', 'sessions', '**'), path.join('agents', '*', 'data', 'channels', '**'),
+        path.join('agents', '*', 'data', 'handoff', '**'), path.join('agents', '*', 'data', 'async-questions', '**'),
+        path.join('agents', '*', 'data', 'task-activity', '**'), path.join('agents', '*', 'data', 'aun', '**'),
+        path.join('agents', '*', 'data', 'outbox.jsonl*'), path.join('agents', '*', 'data', 'activity-outbox.jsonl*'),
+        path.join('agents', '*', 'data', 'contact-audit.jsonl'),
+    ];
+    return entries.map(entry => path.join(root, entry));
+}
+export function getHClassSandboxPatterns(root = resolveRoot(), options = {}) {
+    const absoluteRoot = resolveThroughExistingAncestor(root);
+    assertValidSelfAid(options, 'getHClassSandboxPatterns');
+    if (!normalizeAid(options.selfAid))
+        return getLegacyHClassSandboxPatterns(absoluteRoot);
+    const entries = [
+        'data', path.join('data', '**'),
+        'AIDs', path.join('AIDs', '**'),
+        'aids', path.join('aids', '**'),
         'CA',
         path.join('CA', '**'),
-        path.join('AIDs', '*', 'cert'),
-        path.join('AIDs', '*', 'cert', '**'),
-        path.join('AIDs', '*', 'keys'),
-        path.join('AIDs', '*', 'keys', '**'),
-        path.join('AIDs', '*', 'private'),
-        path.join('AIDs', '*', 'private', '**'),
-        path.join('aids', '*', 'cert'),
-        path.join('aids', '*', 'cert', '**'),
-        path.join('aids', '*', 'keys'),
-        path.join('aids', '*', 'keys', '**'),
-        path.join('aids', '*', 'private'),
-        path.join('aids', '*', 'private', '**'),
-        '.device_id',
-        '.env',
-        '.seed',
-        '.seed.*',
-        '.migrated-*',
-        path.join('**', '*.json_'),
-        path.join('**', '*.json.migrated'),
-        path.join('agents', 'defaults_*.json'),
-        '.lock',
-        'daemon.pid',
-        path.join('data', 'causation-aun.json*'),
-        path.join('data', 'triggers') + '/**',
-        path.join('data', 'sessions') + '/**',
-        path.join('data', 'contact-book-audit.jsonl'),
-        path.join('data', 'feishu-seen-*.jsonl'),
-        path.join('data', '*-greeted-*.jsonl'),
-        path.join('data', 'message-queue.json*'),
-        path.join('data', 'daemon', 'message-queue.json*'),
-        path.join('data', 'daemon', 'control') + '/**',
-        path.join('data', 'daemon', 'migrations') + '/**',
-        path.join('data', 'channel-state') + '/**',
-        path.join('data', 'instance', 'control.token'),
-        path.join('data', 'outbox'),
-        path.join('data', 'outbox') + '/**',
-        path.join('data', 'handoff'),
-        path.join('data', 'handoff') + '/**',
-        path.join('agents', '*', 'sessions', '**'),
-        path.join('agents', '*', 'data', 'channels', '**'),
-        path.join('agents', '*', 'data', 'handoff', '**'),
-        path.join('agents', '*', 'data', 'async-questions', '**'),
-        path.join('agents', '*', 'data', 'aun', '**'),
-        path.join('agents', '*', 'data', 'outbox.jsonl*'),
-        path.join('agents', '*', 'data', 'activity-outbox.jsonl*'),
-        path.join('agents', '*', 'data', 'contact-audit.jsonl'),
+        '.device_id', '.env', '.seed', '.seed.*', '.lock', 'daemon.pid',
+        path.join('agents', options.selfAid, 'data', 'codex-tokens'),
+        path.join('agents', options.selfAid, 'data', 'codex-tokens', '**'),
+        path.join('agents', options.selfAid, 'data', '**', 'context-tokens.json'),
+        path.join('agents', options.selfAid, 'data', '**', 'menu-tokens.json'),
     ];
+    // Exact roots are substantially smaller than `agents/*/**` on Windows and
+    // avoid relying on ACL override precedence to re-open self Agent content.
+    try {
+        for (const entry of fs.readdirSync(path.join(absoluteRoot, 'agents'), { withFileTypes: true })) {
+            if (entry.isDirectory() && entry.name.toLowerCase() !== options.selfAid.toLowerCase()) {
+                entries.push(path.join('agents', entry.name), path.join('agents', entry.name, '**'));
+            }
+        }
+    }
+    catch { }
     return entries.map(entry => path.join(absoluteRoot, entry));
 }
 export function getLClassWritePatterns(root = resolveRoot()) {
@@ -315,7 +436,7 @@ const CODEX_GLOB_MAGIC = /[*?[\]]/;
 // passing it as one CreateProcess argument.  Real Codex 0.154 payloads are
 // roughly 3-5x larger than EvolCore's input map, so leave enough room below
 // Windows' 32,767-character command-line ceiling for helper metadata.
-const CODEX_WINDOWS_FILESYSTEM_RULE_BUDGET_BYTES = 7 * 1024;
+const CODEX_WINDOWS_FILESYSTEM_RULE_BUDGET_BYTES = 10 * 1024;
 const CODEX_WINDOWS_MATERIALIZED_FILE_GLOBS = [
     '**/*.json_',
     '**/*.json.migrated',
@@ -330,13 +451,61 @@ function addExistingTarget(targets, value) {
     }
     catch { }
 }
-export function getExistingHClassMaskTargets(root = resolveRoot()) {
+function getAgentAwareHClassMaskTargets(root, selfAid) {
+    const absoluteRoot = resolveThroughExistingAncestor(root);
+    const targets = new Map();
+    for (const relative of [
+        'data', 'AIDs', 'aids', 'CA',
+        '.device_id', '.env', '.seed', '.lock', 'daemon.pid',
+    ])
+        addExistingTarget(targets, path.join(absoluteRoot, relative));
+    const agentsDir = path.join(absoluteRoot, 'agents');
+    try {
+        for (const entry of fs.readdirSync(agentsDir, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const agentRoot = path.join(agentsDir, entry.name);
+            if (entry.name.toLowerCase() !== selfAid.toLowerCase()) {
+                addExistingTarget(targets, agentRoot);
+                continue;
+            }
+            addExistingTarget(targets, path.join(agentRoot, 'data', 'codex-tokens'));
+            const walk = (directory, depth = 0) => {
+                if (depth > 8)
+                    return;
+                let children;
+                try {
+                    children = fs.readdirSync(directory, { withFileTypes: true });
+                }
+                catch {
+                    return;
+                }
+                for (const child of children) {
+                    const childPath = path.join(directory, child.name);
+                    if (child.isDirectory())
+                        walk(childPath, depth + 1);
+                    else if (/^(?:context-tokens|menu-tokens)\.json(?:_|__|\.tmp-.*)?$/i.test(child.name)) {
+                        addExistingTarget(targets, childPath);
+                    }
+                }
+            };
+            walk(path.join(agentRoot, 'data'));
+        }
+    }
+    catch { }
+    return [...targets.values()];
+}
+export function getExistingHClassMaskTargets(root = resolveRoot(), options = {}) {
+    assertValidSelfAid(options, 'getExistingHClassMaskTargets');
+    const selfAid = normalizeAid(options.selfAid);
+    if (selfAid)
+        return getAgentAwareHClassMaskTargets(root, selfAid);
     const absoluteRoot = resolveThroughExistingAncestor(root);
     const targets = new Map();
     for (const relative of [
         'daemon.json', 'backups/config', '.snapshots', 'CA',
         '.device_id', '.env', '.seed', '.lock', 'daemon.pid',
-        'data/causation-aun.json', 'data/sessions', 'data/triggers', 'data/contact-book-audit.jsonl',
+        'data/causation-aun.json', 'data/contact-book-audit.jsonl',
         'data/message-queue.json', 'data/message-queue.json_', 'data/message-queue.json__',
         'data/daemon/message-queue.json', 'data/daemon/control', 'data/daemon/migrations', 'data/channel-state',
         'data/instance/control.token',
@@ -388,6 +557,7 @@ export function getExistingHClassMaskTargets(root = resolveRoot()) {
             addExistingTarget(targets, path.join(agentRoot, 'data', 'channels'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'handoff'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'async-questions'));
+            addExistingTarget(targets, path.join(agentRoot, 'data', 'task-activity'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'aun'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'outbox.jsonl'));
             addExistingTarget(targets, path.join(agentRoot, 'data', 'activity-outbox.jsonl'));
@@ -410,10 +580,32 @@ export function getExistingHClassMaskTargets(root = resolveRoot()) {
     }
     return [...targets.values()];
 }
-export function getExistingLClassReadOnlyTargets(root = resolveRoot()) {
+export function getExistingLClassReadOnlyTargets(root = resolveRoot(), options = {}) {
+    assertValidSelfAid(options, 'getExistingLClassReadOnlyTargets');
     const targets = new Map();
     const absoluteRoot = resolveThroughExistingAncestor(root);
     const agentsDir = path.join(absoluteRoot, 'agents');
+    const selfAid = normalizeAid(options.selfAid);
+    if (selfAid) {
+        for (const relative of ['daemon.json', 'agents/defaults.json', 'backups/config']) {
+            addExistingTarget(targets, path.join(absoluteRoot, relative));
+        }
+        const ownRoot = path.join(agentsDir, selfAid);
+        for (const relative of [
+            'config.json', 'contact.json', 'contact-operations.jsonl', 'roles', 'triggers',
+        ])
+            addExistingTarget(targets, path.join(ownRoot, relative));
+        try {
+            const relationsDir = path.join(ownRoot, 'relations');
+            for (const relation of fs.readdirSync(relationsDir, { withFileTypes: true })) {
+                if (!relation.isDirectory())
+                    continue;
+                addExistingTarget(targets, path.join(relationsDir, relation.name, 'config.json'));
+            }
+        }
+        catch { }
+        return [...targets.values()];
+    }
     try {
         for (const entry of fs.readdirSync(agentsDir, { withFileTypes: true })) {
             if (!entry.isDirectory())
@@ -425,11 +617,49 @@ export function getExistingLClassReadOnlyTargets(root = resolveRoot()) {
     catch { }
     return [...targets.values()];
 }
+export function getExistingRelationAttachmentDirs(root = resolveRoot(), options = {}) {
+    const absoluteRoot = resolveThroughExistingAncestor(root);
+    const agentsDir = path.join(absoluteRoot, 'agents');
+    const targets = new Set();
+    try {
+        for (const agent of fs.readdirSync(agentsDir, { withFileTypes: true })) {
+            if (!agent.isDirectory())
+                continue;
+            if (options.selfAid) {
+                const isSelf = agent.name.toLowerCase() === options.selfAid.toLowerCase();
+                if (options.onlyOtherAgents ? isSelf : !isSelf)
+                    continue;
+            }
+            const relationsDir = path.join(agentsDir, agent.name, 'relations');
+            for (const relation of fs.readdirSync(relationsDir, { withFileTypes: true })) {
+                if (!relation.isDirectory())
+                    continue;
+                const attachments = path.join(relationsDir, relation.name, 'attachments');
+                try {
+                    if (fs.lstatSync(attachments).isDirectory())
+                        targets.add(attachments);
+                }
+                catch { }
+            }
+        }
+    }
+    catch { }
+    return [...targets];
+}
 export function buildClaudeProtectedFilesystem(root = resolveRoot(), options = {}) {
-    const hClassPaths = getExistingHClassMaskTargets(root).map(target => target.path);
-    const lClassPaths = getExistingLClassReadOnlyTargets(root).map(target => target.path);
-    const allPaths = [...new Set([...hClassPaths, ...lClassPaths])];
-    const denyRead = options.denyLClassRead ? allPaths : hClassPaths;
+    const hClassPaths = [
+        ...getExistingHClassMaskTargets(root, options).map(target => target.path),
+    ];
+    const relationAttachmentPaths = getExistingRelationAttachmentDirs(root, options);
+    const lClassPaths = getExistingLClassReadOnlyTargets(root, options).map(target => target.path);
+    const allPaths = [...new Set([...hClassPaths, ...lClassPaths, ...relationAttachmentPaths])];
+    // Self-Agent relation attachments are ordinary readable content. They stay
+    // in denyWrite so the nested Claude sandbox cannot mutate an uploaded asset;
+    // callers without identity context retain the legacy deny-read behavior.
+    const legacyAttachmentRead = options.selfAid ? [] : relationAttachmentPaths;
+    const denyRead = options.denyLClassRead
+        ? [...new Set([...hClassPaths, ...lClassPaths, ...legacyAttachmentRead])]
+        : [...new Set([...hClassPaths, ...legacyAttachmentRead])];
     if (allPaths.length > CLAUDE_PROTECTED_TARGET_LIMIT) {
         throw new Error(`[ClaudeSandbox] protected target limit exceeded: ${allPaths.length} > ${CLAUDE_PROTECTED_TARGET_LIMIT}`);
     }
@@ -446,14 +676,16 @@ export function buildClaudeProtectedFilesystem(root = resolveRoot(), options = {
         denyWrite: allPaths,
     };
 }
-export function buildCodexHClassFilesystemRules(root = resolveRoot(), platform = process.platform) {
+export function buildCodexHClassFilesystemRules(root = resolveRoot(), platformOrOptions = process.platform) {
+    const options = typeof platformOrOptions === 'string' ? {} : platformOrOptions;
+    const platform = typeof platformOrOptions === 'string' ? platformOrOptions : (platformOrOptions.platform ?? process.platform);
     const filesystem = {
         // Codex pre-expands unbounded deny globs on Linux/WSL/Windows. Without a
         // bound, patterns such as **/*.json_ are accepted but may not be enforced.
         glob_scan_max_depth: 64,
-        ...Object.fromEntries(filterWindowsCodexFilesystemTargets(getHClassSandboxPatterns(root), platform).map(pattern => [pattern, 'deny'])),
+        ...Object.fromEntries(filterWindowsCodexFilesystemTargets(getHClassSandboxPatterns(root, options), platform).map(pattern => [pattern, 'deny'])),
     };
-    return materializeWindowsCodexRecursiveFileDenies(compactWindowsCodexFilesystemRules(filesystem, platform), root, platform);
+    return materializeWindowsCodexRecursiveFileDenies(compactWindowsCodexFilesystemRules(filesystem, platform), root, platform, options);
 }
 /**
  * Windows Codex sandbox setup materializes a path while applying its deny-read
@@ -565,12 +797,12 @@ export function compactWindowsCodexFilesystemRules(filesystem, platform = proces
  * remain dynamic globs, preserving protection for newly created agent/config
  * paths without recreating the unbounded recursive expansion.
  */
-export function materializeWindowsCodexRecursiveFileDenies(filesystem, root = resolveRoot(), platform = process.platform) {
+export function materializeWindowsCodexRecursiveFileDenies(filesystem, root = resolveRoot(), platform = process.platform, options = {}) {
     if (platform !== 'win32')
         return filesystem;
     const absoluteRoot = resolveThroughExistingAncestor(root);
     const materializedPatterns = new Set(CODEX_WINDOWS_MATERIALIZED_FILE_GLOBS.map(pattern => path.join(absoluteRoot, pattern)));
-    const deniedDirectories = getExistingHClassMaskTargets(absoluteRoot)
+    const deniedDirectories = getExistingHClassMaskTargets(absoluteRoot, options)
         .filter(target => target.kind === 'directory')
         .map(target => target.path);
     const projected = {};
@@ -616,7 +848,7 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
     // nested bwrap per-file projection. Callers on platforms without that
     // outer guard retain the historical expansion by default.
     const expandLClassReadDeny = options.expandLClassReadDeny ?? true;
-    for (const target of getExistingLClassReadOnlyTargets(root)) {
+    for (const target of getExistingLClassReadOnlyTargets(root, options)) {
         if (target.kind === 'directory') {
             // :workspace/:read-only already grants L-class read access on Windows.
             // Omitting redundant read ACLs keeps Codex's serialized helper payload
@@ -634,8 +866,11 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
             lClassRules[target.path] = lClassAccess;
         }
     }
+    const hClassOptions = { platform };
+    if (Object.prototype.hasOwnProperty.call(options, 'selfAid'))
+        hClassOptions.selfAid = options.selfAid;
     const filesystem = compactWindowsCodexFilesystemRules({
-        ...buildCodexHClassFilesystemRules(root, platform),
+        ...buildCodexHClassFilesystemRules(root, hClassOptions),
         ...lClassRules,
     }, platform);
     assertWindowsCodexFilesystemRuleBudget(filesystem, platform);
@@ -643,7 +878,7 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
 }
 export function hClassGrantIncludesProtectedPath(value, options = {}) {
     const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());
-    if (containsHClassReference(value))
+    if (containsHClassReference(value, options) || containsAgentScopeReference(value, options))
         return true;
     const normalized = value.replace(/\\/g, '/');
     const globIndex = normalized.search(/[*?[{]/);
@@ -651,12 +886,29 @@ export function hClassGrantIncludesProtectedPath(value, options = {}) {
         ? value
         : normalized.slice(0, globIndex).replace(/\/+$/, '') || '.';
     const candidate = resolveProtectedCandidate(literalGrantRoot, options.cwd);
-    if (isHClassPath(candidate, { root }))
+    if (isHClassPath(candidate, { root, selfAid: options.selfAid }))
         return true;
     if (isSameOrDescendant(root, candidate))
         return true;
     if (!isSameOrDescendant(candidate, root))
         return false;
+    if (options.selfAid) {
+        const relative = path.relative(root, candidate).split(path.sep).filter(Boolean);
+        if (relative[0] === 'data' || relative[0] === 'AIDs' || relative[0] === 'aids')
+            return true;
+        if (relative[0] === 'agents' && relative[1]) {
+            if (relative[1].toLowerCase() !== options.selfAid.toLowerCase())
+                return true;
+            if (relative.length <= 2)
+                return true;
+            if (relative[2] === 'data' && (!relative[3] || ['codex-tokens', 'channels'].includes(relative[3])))
+                return true;
+        }
+        // A grant scoped to an ordinary self-Agent subtree does not automatically
+        // cover an H-class path; this is the distinction that lets sessions,
+        // handoff and outbox remain usable while token/data roots stay protected.
+        return false;
+    }
     // A filesystem grant is a range, not a one-file allow. Every directory
     // below the protected root can contain an H-class backup name (for example
     // *.json_), so an overlay grant there could bypass the baseline deny rules.
@@ -666,7 +918,7 @@ export function lClassGrantIncludesProtectedPath(value, options = {}) {
     if (!value.trim())
         return false;
     const root = resolveThroughExistingAncestor(options.root ?? resolveRoot());
-    if (isLClassPath(value, { cwd: options.cwd, root }))
+    if (isLClassPath(value, { cwd: options.cwd, root, selfAid: options.selfAid }))
         return true;
     const normalized = value.replace(/\\/g, '/');
     const globIndex = normalized.search(/[*?[{]/);
@@ -674,31 +926,29 @@ export function lClassGrantIncludesProtectedPath(value, options = {}) {
         ? value
         : normalized.slice(0, globIndex).replace(/\/+$/, '') || '.';
     const candidate = resolveProtectedCandidate(literalGrantRoot, options.cwd);
-    if (isSameOrDescendant(root, candidate))
+    if (isSameOrDescendant(root, candidate) && candidate === root)
         return true;
     if (!isSameOrDescendant(candidate, root))
         return false;
-    const relative = path.relative(root, candidate);
-    const segments = relative.split(path.sep).filter(Boolean);
-    if (segments[0] === 'data') {
-        if (segments.length === 1)
-            return true;
-        return segments[1] === 'triggers';
-    }
+    const relative = path.relative(root, candidate).split(path.sep).filter(Boolean);
+    const segments = relative;
+    if (segments[0] === 'backups' && segments[1] === 'config')
+        return true;
     if (segments[0] === 'agents') {
-        // The agents root and each individual Agent root contain a roles/ subtree.
+        // A grant covering an Agent root also covers its L-class configuration.
         if (segments.length <= 2)
             return true;
-        return segments[2] === 'roles';
+        return ['config.json', 'contact.json', 'contact-operations.jsonl', 'relations', 'roles', 'triggers']
+            .includes(segments[2]);
     }
     return false;
 }
-export function workspaceContainsHClassPaths(projectPath, root = resolveRoot()) {
+export function workspaceContainsHClassPaths(projectPath, root = resolveRoot(), options = {}) {
     const project = resolveThroughExistingAncestor(projectPath);
     const protectedRoot = resolveThroughExistingAncestor(root);
     if (isSameOrDescendant(protectedRoot, project))
         return true;
     if (!isSameOrDescendant(project, protectedRoot))
         return false;
-    return hClassGrantIncludesProtectedPath(project, { root: protectedRoot });
+    return hClassGrantIncludesProtectedPath(project, { root: protectedRoot, selfAid: options.selfAid });
 }