evolcore 0.0.29 → 0.0.30

package/dist/core/message/aun-ipc-sender.js

@@ -0,0 +1,226 @@
+import { authorizeDelegatedAunMsgSend, } from '../auth/agent-delegation.js';
+import { tryParseChannelKey } from '../channel-loader.js';
+import { AUN_HANDOFF_MARKER_FIELD } from '../../channels/aun.js';
+import { classifyAunPayloadForLog } from './message-log.js';
+import { isValidAunDeliveryForChannel } from './outbound.js';
+import { isHClassPath } from '../permission/protected-paths.js';
+import { evaluateOutboundContactAdmission } from './message-admission.js';
+import { normalizeAunMentionEntries } from '../../aun/msg/mention-schema.js';
+export function createAunHandoffSender(sessionManager, channelInstances) {
+    return async (handoff) => {
+        const targetSession = await sessionManager.getSessionById(handoff.target_session_id);
+        if (!targetSession)
+            return { ok: false, error: 'target session not found' };
+        const instance = channelInstances.find(candidate => (candidate.channelType === 'aun' && (candidate.adapter.channelKey === targetSession.metadata?.channelKey
+            || candidate.adapter.channelName === targetSession.channel
+            || tryParseChannelKey(candidate.adapter.channelKey)?.selfAID === targetSession.selfAID)));
+        const channel = instance?.channel;
+        if (!channel) {
+            return { ok: false, error: `AUN channel not found for ${targetSession.selfAID || '<unknown>'}` };
+        }
+        const classified = classifyAunPayloadForLog(handoff.request.payload);
+        const log = {
+            content: classified.content,
+            sessionId: targetSession.id,
+            threadId: targetSession.threadId || null,
+            msgType: classified.msgType,
+            payloadType: classified.payloadType,
+            payloadSummary: classified.payloadSummary,
+            source: 'msg',
+            handoffTrace: { version: 2, handoff_id: handoff.handoff_id },
+        };
+        const delivery = handoff.request.delivery;
+        if (!isValidAunDeliveryForChannel(delivery, targetSession.channelId)) {
+            return { ok: false, error: 'handoff is missing a valid immutable AUN delivery route' };
+        }
+        const result = delivery.chatType === 'group'
+            ? typeof channel.sendDaemonGroupMsg === 'function'
+                ? await channel.sendDaemonGroupMsg({
+                    groupId: delivery.groupId,
+                    payload: { ...handoff.request.payload, [AUN_HANDOFF_MARKER_FIELD]: handoff.handoff_id },
+                    encrypt: handoff.request.encrypt,
+                    causation: handoff.causation,
+                    log,
+                })
+                : { ok: false, error: 'AUN channel does not support daemon group sends' }
+            : typeof channel.sendDaemonMsg === 'function'
+                ? await channel.sendDaemonMsg({
+                    to: targetSession.channelId,
+                    payload: handoff.request.payload,
+                    encrypt: handoff.request.encrypt,
+                    causation: handoff.causation,
+                    log,
+                })
+                : { ok: false, error: 'AUN channel does not support daemon private sends' };
+        return { ok: result.ok, message_id: result.message_id, error: result.error };
+    };
+}
+export function registerAunIpcSender({ ipcServer, channelInstances, agentDelegationRegistry, responseEngine, handoffRuntime, }) {
+    const sender = async (params) => {
+        const runtimeCausation = params.originSessionId
+            ? responseEngine.getTaskRuntimeContext(params.originSessionId)?.causation
+            : undefined;
+        const delegation = authorizeDelegatedAunMsgSend(agentDelegationRegistry, {
+            delegationToken: params.delegationToken,
+            delegationCommandHash: params.delegationCommandHash,
+            sessionId: params.originSessionId,
+            messageId: params.originMessageId,
+            aid: params.aid,
+            to: params.to,
+            scope: params.scope,
+            action: params.file ? 'file' : 'send',
+        });
+        if (!delegation.ok) {
+            return { ok: false, error: delegation.reason, code: delegation.code };
+        }
+        const inst = channelInstances.find((candidate) => {
+            if (candidate.channelType !== 'aun')
+                return false;
+            const ch = candidate.channel;
+            try {
+                const aidState = typeof ch?.getAidState === 'function' ? ch.getAidState() : null;
+                if (aidState?.aid === params.aid)
+                    return true;
+                if (typeof ch?.getAid === 'function' && ch.getAid() === params.aid)
+                    return true;
+            }
+            catch { /* ignore */ }
+            return false;
+        });
+        const ch = inst?.channel;
+        if (!ch) {
+            return { ok: false, error: `AUN channel not found for ${params.aid}`, code: 'AUN_CHANNEL_NOT_FOUND' };
+        }
+        if (params.scope === 'msg') {
+            const admission = await evaluateOutboundContactAdmission({ selfAid: params.aid, targetAid: params.to });
+            if (!admission.allow) {
+                return { ok: false, error: admission.error, code: admission.code };
+            }
+        }
+        // The IPC command already carries the caller-selected transport scope.
+        // Never reclassify the target by parsing its AID string: a private AID may
+        // look group-like and a group identifier may use a future format.
+        const encrypt = typeof params.encrypt === 'boolean'
+            ? params.encrypt
+            : (typeof ch.getDefaultEncrypt === 'function' ? ch.getDefaultEncrypt() : true);
+        let payload = params.payload;
+        if (params.file) {
+            if (isHClassPath(params.file.filePath)) {
+                return {
+                    ok: false,
+                    error: 'H-class protected files cannot be uploaded by an agent task',
+                    code: 'H_CLASS_PROTECTED',
+                };
+            }
+            if (typeof ch.buildDaemonFilePayload !== 'function') {
+                return { ok: false, error: 'AUN channel does not support daemon file uploads', code: 'AUN_FILE_UNSUPPORTED' };
+            }
+            try {
+                payload = await ch.buildDaemonFilePayload(params.file);
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    error: error instanceof Error ? error.message : String(error),
+                    code: error?.code ?? 'AUN_FILE_UPLOAD_FAILED',
+                };
+            }
+        }
+        if (!payload) {
+            return { ok: false, error: 'message payload is required', code: 'INVALID_PAYLOAD' };
+        }
+        try {
+            if (Object.prototype.hasOwnProperty.call(payload, 'mentions')) {
+                payload = { ...payload, mentions: normalizeAunMentionEntries(payload.mentions) };
+            }
+            if (params.scope === 'group' && params.mentions !== undefined) {
+                const normalizedMentions = normalizeAunMentionEntries(params.mentions);
+                if (normalizedMentions.length > 0) {
+                    payload = { ...payload, mentions: normalizedMentions };
+                }
+            }
+        }
+        catch (error) {
+            return {
+                ok: false,
+                error: error instanceof Error ? error.message : String(error),
+                code: error?.code ?? 'INVALID_MENTION_SCHEMA',
+            };
+        }
+        if (params.thread && typeof payload.thread_id !== 'string') {
+            payload = { ...payload, thread_id: params.thread };
+        }
+        let targetSessionId;
+        if (params.originSessionId && params.originMessageId) {
+            try {
+                const created = await handoffRuntime.createOutbound({
+                    selfAid: params.aid,
+                    to: params.to,
+                    originSessionId: params.originSessionId,
+                    originMessageId: params.originMessageId,
+                    payload,
+                    encrypt,
+                    thread: params.thread,
+                    targetChatType: params.scope === 'group' ? 'group' : 'private',
+                    explicitReturnPolicy: params.returnPolicy,
+                    handoffContext: params.handoffContext,
+                    originAuthorization: {
+                        actorId: delegation.grant.actorId,
+                        channelKey: delegation.grant.channel,
+                        channelType: delegation.grant.channelType,
+                        chatType: delegation.grant.chatType,
+                        peerKey: delegation.grant.peerKey,
+                    },
+                    causation: runtimeCausation,
+                });
+                targetSessionId = created.targetSession.id;
+                if (created.crossSession && created.handoff) {
+                    return {
+                        ok: true,
+                        status: created.handoff.state === 'target_sent' ? 'delivered' : 'queued',
+                        message_id: created.handoff.target_message_id ?? undefined,
+                        handoff_id: created.handoff.handoff_id,
+                        target_session_id: created.targetSession.id,
+                    };
+                }
+                if (params.scope === 'msg' && !payload.ref_message_id) {
+                    payload.ref_message_id = params.originMessageId;
+                }
+            }
+            catch (error) {
+                const code = error?.code;
+                const handoffId = error?.handoffId
+                    ?? error?.blockingHandoffId;
+                return {
+                    ok: false,
+                    error: error instanceof Error ? error.message : String(error),
+                    code,
+                    ...(handoffId ? { handoff_id: handoffId } : {}),
+                };
+            }
+        }
+        if (params.scope === 'group') {
+            if (typeof ch.sendDaemonGroupMsg !== 'function') {
+                return { ok: false, error: 'AUN channel does not support daemon group sends', code: 'AUN_GROUP_UNSUPPORTED' };
+            }
+            return await ch.sendDaemonGroupMsg({
+                groupId: params.to,
+                payload,
+                mentions: params.mentions,
+                encrypt,
+                log: params.log ? { ...params.log, sessionId: targetSessionId ?? params.log.sessionId } : undefined,
+            });
+        }
+        if (typeof ch.sendDaemonMsg !== 'function') {
+            return { ok: false, error: 'AUN channel does not support daemon private sends', code: 'AUN_MSG_UNSUPPORTED' };
+        }
+        return await ch.sendDaemonMsg({
+            to: params.to,
+            payload,
+            encrypt,
+            causation: runtimeCausation,
+            log: params.log ? { ...params.log, sessionId: targetSessionId ?? params.log.sessionId } : undefined,
+        });
+    };
+    ipcServer.setAunMsgSender(sender);
+}

package/dist/core/message/outbound.js

@@ -0,0 +1,165 @@
+import { isDeliveryTargetForChannel } from './message-utils.js';
+import { readEvolcoreRuntimeFlavor, readEvolcoreStartedAtIso, readInstalledEvolcoreVersion, tagErrorTextWithEvolcoreVersion, } from '../../utils/evolcore-version.js';
+/** 出站 payload 摘要（用于 channel-out.log）。 */
+export function summarizeOutboundPayload(payload) {
+    if (!payload)
+        return { kind: 'unknown' };
+    const summary = { kind: payload.kind };
+    switch (payload.kind) {
+        case 'activity.batch':
+            summary.itemCount = payload.items?.length ?? 0;
+            summary.items = payload.items;
+            break;
+        case 'result.text':
+            summary.isFinal = payload.isFinal;
+            summary.text = payload.text;
+            break;
+        case 'command.result':
+        case 'command.error':
+        case 'result.error':
+            summary.text = payload.text;
+            break;
+        case 'result.file':
+            summary.filePath = payload.filePath;
+            break;
+        case 'system.notice':
+        case 'system.error':
+            summary.subtype = payload.subtype;
+            summary.text = payload.text;
+            break;
+        case 'interaction':
+            summary.interactionId = payload.interaction?.id;
+            summary.interactionKind = payload.interaction?.kind?.kind;
+            break;
+        case 'status.started':
+        case 'status.progress':
+        case 'status.notice':
+        case 'status.requires_action':
+        case 'status.queued':
+        case 'status.completed':
+        case 'status.interrupted':
+        case 'status.error':
+        case 'status.timeout':
+            summary.metadata = payload.metadata;
+            break;
+    }
+    return summary;
+}
+/** Add the current EvolCore version marker to user-visible error payloads. */
+export function tagErrorPayloadWithEvolcoreVersion(payload) {
+    switch (payload.kind) {
+        case 'result.error':
+        case 'system.error':
+            return { ...payload, text: tagErrorTextWithEvolcoreVersion(payload.text) };
+        case 'command.error':
+            if (!payload.reasonCode)
+                return payload;
+            return { ...payload, text: tagErrorTextWithEvolcoreVersion(payload.text) };
+        case 'status.error': {
+            const metadata = payload.metadata;
+            return {
+                ...payload,
+                metadata: {
+                    ...metadata,
+                    ...(typeof metadata?.message === 'string'
+                        ? { message: tagErrorTextWithEvolcoreVersion(metadata.message) }
+                        : {}),
+                    evolcoreVersion: readInstalledEvolcoreVersion(),
+                    evolcoreFlavor: readEvolcoreRuntimeFlavor(),
+                    evolcoreStartedAt: readEvolcoreStartedAtIso(),
+                },
+            };
+        }
+        default:
+            return payload;
+    }
+}
+export function shouldCountSentPayload(payload) {
+    return [
+        'result.text',
+        'result.file',
+        'result.image',
+        'result.error',
+        'command.result',
+        'command.error',
+        'interaction',
+    ].includes(payload.kind);
+}
+export function outboundPayloadToLogText(payload) {
+    switch (payload.kind) {
+        case 'result.text':
+        case 'command.result':
+        case 'command.error':
+        case 'result.error':
+            return { text: payload.text, msgType: 'text' };
+        case 'result.file':
+            return { text: payload.fileName || payload.filePath, msgType: 'file' };
+        case 'result.image':
+            return { text: payload.alt || '[image]', msgType: 'image' };
+        case 'interaction':
+            return { text: payload.fallbackText || '[interaction]', msgType: 'text' };
+        default:
+            return null;
+    }
+}
+export function normalizeMessageSource(value) {
+    return value === 'cli' || value === 'msg' || value === 'ctl' || value === 'owner-inject'
+        ? value
+        : 'daemon';
+}
+/** Preserve the authenticated AUN route for control-plane replies. */
+export function controlReplyContext(opts, metadata) {
+    const supplied = opts.replyContext?.delivery;
+    if (supplied) {
+        const matchesInbound = opts.chatType === 'group'
+            ? supplied.chatType === 'group' && supplied.groupId === opts.groupId
+            : supplied.chatType === 'private';
+        if (!matchesInbound) {
+            throw Object.assign(new Error('AUN control reply route does not match its authenticated inbound context'), {
+                code: 'AUN_OUTBOUND_ROUTE_MISMATCH',
+            });
+        }
+    }
+    const delivery = supplied
+        ?? (opts.chatType === 'group'
+            ? (opts.groupId ? { chatType: 'group', groupId: opts.groupId } : undefined)
+            : { chatType: 'private' });
+    if (!delivery) {
+        throw Object.assign(new Error('AUN control reply is missing a trusted groupId'), {
+            code: 'AUN_OUTBOUND_ROUTE_REQUIRED',
+        });
+    }
+    return {
+        ...(opts.replyContext ?? {}),
+        delivery,
+        metadata: {
+            ...(opts.replyContext?.metadata ?? {}),
+            ...(opts.encrypted === undefined ? {} : { encrypted: opts.encrypted }),
+            ...(opts.protectedHeaders ? { protectedHeaders: opts.protectedHeaders } : {}),
+            ...(metadata ?? {}),
+        },
+    };
+}
+export function isValidAunDeliveryForChannel(delivery, channelId) {
+    return isDeliveryTargetForChannel(delivery, channelId);
+}
+function restartChannelType(channel) {
+    return channel?.split('#', 1)[0].toLowerCase();
+}
+/** Restore a persisted restart route without inferring AUN group semantics. */
+export function resolvePersistedRestartDelivery(opts) {
+    const requiresAunRoute = restartChannelType(opts.channel) === 'aun'
+        || restartChannelType(opts.adapterChannel) === 'aun';
+    if (!requiresAunRoute) {
+        return isDeliveryTargetForChannel(opts.delivery, opts.channelId)
+            ? { valid: true, delivery: opts.delivery }
+            : { valid: true };
+    }
+    return isDeliveryTargetForChannel(opts.delivery, opts.channelId)
+        ? { valid: true, delivery: opts.delivery }
+        : { valid: false };
+}
+/** Send a system payload through the channel's unified outbound entry point. */
+export async function sendSystemPayload(adapter, envelope, payload) {
+    await adapter.send(envelope, payload);
+}

package/dist/core/permission/approval-gateway.js

@@ -9,6 +9,7 @@ import { recordCausationSpan } from '../causation/audit.js';
 import { checkDangerousCommand } from './tool-policy.js';
 import { resolveProtectedCandidate } from './protected-paths.js';
 import { auditPermissionDecision, auditPermissionLifecycle } from '../auth/authorization-audit.js';
+import { ConfigTarget, onConfigWrite } from '../../config/config-manager.js';
 export async function requestDangerousCommandPermission(gateway, sessionId, toolName, input, sendPrompt, context, grantScope = 'default', mode = 'request') {
     const dangerCheck = checkDangerousCommand(toolName, input);
     if (!dangerCheck.isDangerous) {
@@ -302,6 +303,18 @@ export class PermissionGateway {
     temporaryGrants = new Map();
     managementRevalidationTimer;
     eventBus;
+    registerConfigRevalidation() {
+        return onConfigWrite(({ target, selector }) => {
+            if ((target !== ConfigTarget.Agent
+                && target !== ConfigTarget.Contact
+                && target !== ConfigTarget.Relation) || !selector.self)
+                return;
+            const cancelled = this.revalidatePendingApprovals(selector.self);
+            if (cancelled > 0) {
+                logger.info(`[PermissionGateway] Cancelled ${cancelled} stale management approval(s) after ${target} config write: agent=${selector.self}`);
+            }
+        });
+    }
     setEventBus(eventBus) {
         this.eventBus = eventBus;
     }

package/dist/core/permission/ec-command-parser.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { isTrustedWindowsShellExecutable } from '../../utils/windows-shell-trust.js';
-function parseApplyPatchCommand(command) {
+function parseApplyPatchCommand(command, options = {}) {
     const input = command.trim();
     let commandText = input;
     if (commandText.startsWith('&'))
@@ -14,15 +14,10 @@ function parseApplyPatchCommand(command) {
         return { kind: 'not-apply-patch' };
     const remainder = commandText.slice(executableMatch[0].length).trimStart();
     if (!remainder)
-        return { kind: 'invalid', reason: 'missing patch document' };
-    const literal = parseLiteralShellCommand(input, { allowManagedTmpDir: true });
+        return parseApplyPatchArgv([executable]);
+    const literal = parseLiteralShellCommand(commandText, { ...options, allowManagedTmpDir: true });
     if (literal.ok && argvUsesShellApplyPatch(literal.argv)) {
-        if (literal.argv.length !== 2)
-            return { kind: 'invalid', reason: 'apply_patch must carry exactly one patch document' };
-        const fileChanges = parseApplyPatchDocument(literal.argv[1]);
-        return fileChanges
-            ? { kind: 'file-change', fileChanges }
-            : { kind: 'invalid', reason: 'patch document is not a complete apply_patch document' };
+        return parseApplyPatchArgv(literal.argv);
     }
     const heredoc = remainder.match(/^<<-?\s*(?:'([^']+)'|"([^"]+)"|([^\s]+))\s*\r?\n([\s\S]*)$/u);
     if (!heredoc)
@@ -38,12 +33,64 @@ function parseApplyPatchCommand(command) {
         ? { kind: 'file-change', fileChanges }
         : { kind: 'invalid', reason: 'patch document is not a complete apply_patch document' };
 }
-function composedApplyPatchOnCommandLine(command) {
-    const commandLine = command.split(/\r?\n/u, 1)[0] ?? command;
-    return commandLine.split(/[|;&]/u).slice(1).some(segment => {
-        const executable = leadingShellExecutable(segment);
-        return !!executable && isApplyPatchExecutable(executable);
-    });
+function parseApplyPatchArgv(argv) {
+    if (!argvUsesShellApplyPatch(argv))
+        return { kind: 'not-apply-patch' };
+    if (argv.length !== 2 || !argv[1].trimStart().startsWith('*** ')) {
+        return {
+            kind: 'invalid',
+            reason: 'apply_patch requires exactly one complete patch document',
+            errorDetailCode: 'INVALID_ARGUMENT',
+        };
+    }
+    const fileChanges = parseApplyPatchDocument(argv[1]);
+    return fileChanges
+        ? { kind: 'file-change', fileChanges }
+        : { kind: 'invalid', reason: 'patch document is not a complete apply_patch document' };
+}
+function composedApplyPatchOnCommandLine(command, options = {}) {
+    const commandText = stripHeredocBodies(command);
+    const escape = options.dialect === 'powershell' ? '`' : options.dialect === 'cmd' ? '^' : '\\';
+    let quote = null;
+    for (let index = 0; index < commandText.length; index++) {
+        const char = commandText[index];
+        if (quote === 'single') {
+            if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (char === escape) {
+            index++;
+            continue;
+        }
+        if (quote === 'double') {
+            if (char === '"')
+                quote = null;
+            continue;
+        }
+        if (char === "'" && options.dialect !== 'cmd') {
+            quote = 'single';
+            continue;
+        }
+        if (char === '"') {
+            quote = 'double';
+            continue;
+        }
+        if (char === '#' && options.dialect !== 'cmd'
+            && (index === 0 || /\s/u.test(commandText[index - 1]))) {
+            const newline = commandText.indexOf('\n', index);
+            if (newline < 0)
+                break;
+            index = newline - 1;
+            continue;
+        }
+        if (char === '|' || char === ';' || char === '&' || char === '\r' || char === '\n') {
+            const executable = leadingShellExecutable(commandText.slice(index + 1));
+            if (executable && isApplyPatchExecutable(executable))
+                return true;
+        }
+    }
+    return false;
 }
 export function parseShellApplyPatchInvocation(input, options = {}, parsedArgv) {
     const rawCommand = typeof input.command === 'string' ? input.command : '';
@@ -56,39 +103,37 @@ export function parseShellApplyPatchInvocation(input, options = {}, parsedArgv)
         if (value && !candidates.includes(value))
             candidates.push(value);
     };
-    addCandidate(rawCommand);
+    const carrier = rawCommandArgv
+        ? resolveCodexShellCarrierArgv(rawCommandArgv)
+        : resolveCodexShellCarrierString(rawCommand);
     if (rawCommandArgv) {
         if (argvUsesShellApplyPatch(rawCommandArgv)) {
-            if (rawCommandArgv.length === 2) {
-                const fileChanges = parseApplyPatchDocument(rawCommandArgv[1]);
-                return fileChanges
-                    ? { kind: 'file-change', fileChanges }
-                    : { kind: 'invalid', reason: 'patch document is not a complete apply_patch document' };
-            }
-            return { kind: 'invalid', reason: 'apply_patch must carry exactly one patch document' };
+            return parseApplyPatchArgv(rawCommandArgv);
         }
-        addCandidate(resolveCodexShellCarrierArgv(rawCommandArgv)?.command);
     }
+    else {
+        addCandidate(rawCommand);
+    }
+    addCandidate(carrier?.command);
     if (parsedArgv && argvUsesShellApplyPatch(parsedArgv)) {
-        return { kind: 'invalid', reason: 'apply_patch payload could not be reconstructed safely' };
+        return parseApplyPatchArgv(parsedArgv);
     }
-    addCandidate(resolveCodexShellCarrierString(rawCommand)?.command);
-    let sawApplyPatch = false;
-    let invalidReason = 'apply_patch payload could not be reconstructed safely';
+    let invalid;
     for (const candidate of candidates) {
-        const parsed = parseApplyPatchCommand(candidate);
+        const candidateOptions = candidate === carrier?.command
+            ? { ...options, dialect: carrier.dialect }
+            : options;
+        const parsed = parseApplyPatchCommand(candidate, candidateOptions);
         if (parsed.kind !== 'not-apply-patch') {
-            sawApplyPatch = true;
             if (parsed.kind === 'file-change')
                 return parsed;
-            invalidReason = parsed.reason;
+            invalid = parsed;
         }
-        else if (composedApplyPatchOnCommandLine(candidate)) {
-            sawApplyPatch = true;
-            invalidReason = 'apply_patch must be the only shell command';
+        else if (composedApplyPatchOnCommandLine(candidate, candidateOptions)) {
+            invalid = { kind: 'invalid', reason: 'apply_patch must be the only shell command' };
         }
     }
-    return sawApplyPatch ? { kind: 'invalid', reason: invalidReason } : { kind: 'not-apply-patch' };
+    return invalid ?? { kind: 'not-apply-patch' };
 }
 /**
  * stdout filters allowed after an EC invocation. Each entry reads stdin and

package/dist/core/permission/sandbox-runtime.js

@@ -298,6 +298,11 @@ function pushWritableBind(args, candidate) {
         return;
     args.push('--bind', candidate, candidate);
 }
+function pushReadonlyBind(args, candidate) {
+    if (!fs.existsSync(candidate))
+        return;
+    args.push('--ro-bind', candidate, candidate);
+}
 function pushMaskedFile(args, candidate) {
     if (!fs.existsSync(candidate))
         return;
@@ -658,7 +663,10 @@ export function buildBubblewrapCommand(executable, executableArgs, options) {
         '--proc', '/proc',
         '--tmpfs', '/tmp',
     ];
-    pushWritableBind(args, projectPath);
+    if (options.projectWritable === false)
+        pushReadonlyBind(args, projectPath);
+    else
+        pushWritableBind(args, projectPath);
     for (const writablePath of options.writablePaths ?? []) {
         const resolved = path.resolve(writablePath);
         if (isSameOrDescendant(resolved, projectPath))
@@ -671,9 +679,22 @@ export function buildBubblewrapCommand(executable, executableArgs, options) {
             continue;
         args.push('--ro-bind', resolved, resolved);
     }
+    for (const maskedPath of options.maskedPaths ?? []) {
+        const resolved = path.resolve(maskedPath);
+        if (isSameOrDescendant(projectPath, resolved))
+            continue;
+        if (fs.existsSync(resolved)) {
+            const stat = fs.lstatSync(resolved);
+            if (stat.isDirectory())
+                pushMaskedDirectory(args, resolved);
+            else
+                pushMaskedFile(args, resolved);
+        }
+    }
     appendLClassReadOnlyBinds(args, root, options);
     appendHClassMasks(args, root, true, options);
-    appendDaemonIpcSocket(args, root);
+    if (options.exposeDaemonIpc !== false)
+        appendDaemonIpcSocket(args, root);
     args.push('--chdir', projectPath, '--', executable, ...executableArgs);
     return { command: bubblewrapPath, args };
 }

package/dist/core/permission/tool-error-code.js

@@ -7,6 +7,7 @@ const PERMISSION_ERROR_CODES = new Set([
 ]);
 const DETAIL_CODE_BY_POLICY_CODE = {
     native_file_change_required: 'NATIVE_FILE_CHANGE_REQUIRED',
+    apply_patch_invalid_argument: 'INVALID_ARGUMENT',
     apply_patch_unparseable: 'APPLY_PATCH_UNPARSEABLE',
     apply_patch_workspace_escape: 'APPLY_PATCH_WORKSPACE_ESCAPE',
     ec_shell_invalid_quote: 'INVALID_QUOTE',