evolcore 0.0.33 → 0.0.35-test.0

package/dist/core/permission/ec-command-parser.js

@@ -619,6 +619,10 @@ function isLiteralArgBoundary(value) {
  * 判为 `shell-composition`，拦截力度不变，只让错误归因准确。
  */
 function isPosixQuotedTokenBoundary(value) {
+    // 相邻引号段直接拼接（`'a''b'`、`$'a''b'`、`'a'"b"`）与 bash 一致：
+    // 闭合引号后紧跟另一个开引号不是错误，两个段拼进同一个 token。
+    if (value === "'" || value === '"')
+        return true;
     return value === undefined || isShellSpacing(value) || SHELL_UNQUOTED_META.has(value);
 }
 function isShellParameterExpansionStart(value) {
@@ -714,6 +718,77 @@ function decodePositionalText(argv, start, optionFlags) {
         argv[index] = decodeEvolcoreInlineText(value);
     }
 }
+// 取值为「逗号分隔、单项不含空格」的列表参数。aid、标签值、角色名里都不会有
+// 空格，所以按空格拆分是安全的。
+const MEMORY_LIST_FLAGS = new Set(['--tags', '--speakers']);
+const SEND_LIST_FLAGS = new Set(['--mention']);
+const FS_LIST_FLAGS = new Set(['--allow-roles']);
+// 取值可能含空格的列表参数，只能按逗号拆：关键词是自由文本，记忆路径是 config
+// 相对路径，两者都可能有空格。
+const MEMORY_COMMA_ONLY_FLAGS = new Set(['--keywords', '--replaces']);
+/** 逗号分隔项：去空、去首尾空白，重新用逗号连接。 */
+function joinCommaList(value) {
+    return value.split(',').map(item => item.trim()).filter(Boolean).join(',');
+}
+/**
+ * 把列表参数统一成逗号分隔。PowerShell 把未加引号的 `a,b` 当数组，经 npm 的
+ * ec.ps1 用 `$args` 转发给 node 时逗号消失：`a,b` 变成 `a b`，`a, b` 和
+ * `a,b, c` 也变成 `a b` / `a b c`（实测 PS 5.1）。审批侧按命令串解析时看到的
+ * 是 `a,` 和 `b` 两个 token。两边在这里收敛到同一表示，委托哈希才能对上。
+ *
+ * 值以逗号结尾说明逗号数组还没结束：把后续 token 并进同一个值里再拆。值里本来
+ * 带逗号却没有空格的写法（bash 下 `--tags "a, b"`）也会被拆成两个标签，这是刻
+ * 意取舍——标签都是不含空格的单词，而 ec.ps1 已经把 `a, b` 和 `a,b` 归成了一
+ * 个值，无法再区分。
+ */
+function canonicalizeListFlags(argv, flags) {
+    for (let index = 0; index < argv.length; index++) {
+        const value = argv[index];
+        if (value === '--')
+            break;
+        if (!flags.has(value))
+            continue;
+        if (argv[index + 1] === undefined || argv[index + 1].startsWith('--'))
+            continue;
+        // `--tags a, b` 在 PowerShell 里是同一个值，审批侧却解析成 `a,` 加 `b`，
+        // 这里按逗号是否收尾把后续 token 续接回来
+        let end = index + 1;
+        while (argv[end].endsWith(',') && argv[end + 1] !== undefined
+            && !argv[end + 1].startsWith('--')) {
+            end++;
+        }
+        argv[index + 1] = argv.slice(index + 1, end + 1)
+            .join(' ')
+            .split(/[,\s]+/u)
+            .filter(Boolean)
+            .join(',');
+        if (end > index + 1)
+            argv.splice(index + 2, end - index - 1);
+        index++;
+    }
+}
+/**
+ * 只按逗号归一化，不动值里的空格。
+ *
+ * 与 canonicalizeListFlags 的区别：`--keywords 'a b'` 是一个含空格的关键词，
+ * 不能被拆成两个。所以只在值本身带逗号时整理（顺带去掉逗号周围的空白），
+ * `--keywords a,b` 这种未加引号的写法在 PowerShell 下会先被折成 `a b`，此处
+ * 认不出来——那属于被拒绝的写法，靠规范要求单引号避免。
+ */
+function canonicalizeCommaOnlyFlags(argv, flags) {
+    for (let index = 0; index < argv.length; index++) {
+        const value = argv[index];
+        if (value === '--')
+            break;
+        if (!flags.has(value))
+            continue;
+        const next = argv[index + 1];
+        if (next === undefined || next.startsWith('--') || !next.includes(','))
+            continue;
+        argv[index + 1] = joinCommaList(next);
+        index++;
+    }
+}
 function canonicalizeHandoffText(argv) {
     const action = argv[2];
     if (action !== 'return' && action !== 'recover-return')
@@ -739,7 +814,8 @@ function canonicalizeHandoffText(argv) {
  * Convert an EC invocation to the one argv representation shared by approval,
  * delegation hashing, IPC, and command execution. Shell syntax is already
  * resolved before this function is called; this function only normalizes the
- * EC entrypoint and applies the command-specific inline text contract.
+ * EC entrypoint, applies the command-specific inline text contract, and joins
+ * memory list flags with commas.
  */
 export function canonicalizeEvolcoreCommandArgv(argv) {
     const canonical = normalizeEvolcoreCommandArgv(argv);
@@ -759,11 +835,13 @@ export function canonicalizeEvolcoreCommandArgv(argv) {
     else if (command === 'msg' && subcommand === 'send') {
         decodeInlineFlags(result, INLINE_TEXT_FLAGS.msgSend);
         decodePositionalText(result, 5, MESSAGE_POSITIONAL_FLAGS);
+        canonicalizeListFlags(result, SEND_LIST_FLAGS);
     }
     else if (command === 'group') {
         if (subcommand === 'send') {
             decodeInlineFlags(result, INLINE_TEXT_FLAGS.groupSend);
             decodePositionalText(result, 5, MESSAGE_POSITIONAL_FLAGS);
+            canonicalizeListFlags(result, SEND_LIST_FLAGS);
         }
         else if (subcommand === 'create')
             decodeInlineFlags(result, INLINE_TEXT_FLAGS.groupCreate);
@@ -785,6 +863,13 @@ export function canonicalizeEvolcoreCommandArgv(argv) {
     else if (command === 'handoff') {
         canonicalizeHandoffText(result);
     }
+    else if (command === 'memory') {
+        canonicalizeListFlags(result, MEMORY_LIST_FLAGS);
+        canonicalizeCommaOnlyFlags(result, MEMORY_COMMA_ONLY_FLAGS);
+    }
+    else if (command === 'fs' && subcommand === 'chmod') {
+        canonicalizeListFlags(result, FS_LIST_FLAGS);
+    }
     return result;
 }
 const POWERSHELL_CREDENTIAL_ENV_RE = /^(EVOLCORE_CODEX_SESSION_TOKEN|EVOLCORE_DELEGATION_TOKEN)$/i;
@@ -1496,6 +1581,8 @@ export function parseLiteralShellCommand(command, options = {}) {
     let token = '';
     let tokenStarted = false;
     let quote = null;
+    // EC 命令的自由文本有额外的写法约束（见双引号分支的反引号/$ 转义处理）。
+    const isEcCommand = hasEcCommandPrefix(input);
     const finishToken = () => {
         if (!tokenStarted)
             return;
@@ -1527,6 +1614,12 @@ export function parseLiteralShellCommand(command, options = {}) {
                 return parseFailure(issue, input, index, argv.length, 'posix');
             if (char === '\\') {
                 const next = input[++index];
+                // EC 自由文本只接受单引号一种写法。双引号里用反斜杠转义 ` 或 $ 虽然
+                // 能得到字面量，但同一条规则下要记两套写法，所以对 ec 命令显式拒绝，
+                // 把正文一律导向单引号。非 ec 命令保持原行为。
+                if (isEcCommand && (next === '`' || next === '$')) {
+                    return parseFailure('unsupported-escape', input, index, argv.length, 'posix');
+                }
                 token += ['"', '\\', '$', '`'].includes(next) ? next : `\\${next}`;
                 continue;
             }
@@ -1568,6 +1661,54 @@ export function parseLiteralShellCommand(command, options = {}) {
             token += next;
             continue;
         }
+        // ANSI-C quoting: $'...' allows \n \t \r \\ \' escapes, same as bash $'...'.
+        // Must be checked before SHELL_UNQUOTED_META because $ is in that set.
+        if (char === '$' && input[index + 1] === "'") {
+            tokenStarted = true;
+            index += 2; // skip $ and opening '
+            let ansiClosed = false;
+            while (index < input.length) {
+                const c = input[index];
+                if (c === "'") {
+                    ansiClosed = true;
+                    break; // leave index at closing '; for-loop increment moves past it
+                }
+                if (c === '\\') {
+                    const esc = input[++index];
+                    if (esc === undefined)
+                        break;
+                    switch (esc) {
+                        case 'n':
+                            token += '\n';
+                            break;
+                        case 't':
+                            token += '\t';
+                            break;
+                        case 'r':
+                            token += '\r';
+                            break;
+                        case '\\':
+                            token += '\\';
+                            break;
+                        case "'":
+                            token += "'";
+                            break;
+                        default:
+                            token += `\\${esc}`;
+                            break;
+                    }
+                    index++;
+                    continue;
+                }
+                token += c;
+                index++;
+            }
+            if (!ansiClosed)
+                return parseFailure('invalid-quote', input, index, argv.length, 'posix');
+            if (!isPosixQuotedTokenBoundary(input[index + 1]))
+                return parseFailure('invalid-quote', input, index, argv.length, 'posix');
+            continue;
+        }
         // `#` starts a shell comment only at the beginning of a word. Channel
         // peer keys such as `aun#alice` are ordinary literal arguments.
         if ((SHELL_UNQUOTED_META.has(char) && (char !== '#' || !tokenStarted))
@@ -1623,6 +1764,11 @@ export function parseCodexShellCommandArgv(command, options = {}) {
         });
         return parsed.ok ? canonicalizeEvolcoreCommandArgv(parsed.argv) : null;
     }
+    const stringCarrier = resolveCodexShellCarrierString(command);
+    if (stringCarrier) {
+        const parsed = parseCodexCarrierCommand(stringCarrier, options);
+        return parsed.ok ? normalizeEvolcoreCommandArgv(parsed.argv) : null;
+    }
     const outer = parseLiteralShellArgv(command, options);
     if (outer) {
         const carrier = resolveCodexShellCarrierArgv(outer);
@@ -1630,20 +1776,11 @@ export function parseCodexShellCommandArgv(command, options = {}) {
             const parsed = parseCodexCarrierCommand(carrier, options);
             return parsed.ok ? parsed.argv : null;
         }
-        const stringCarrier = resolveCodexShellCarrierString(command);
-        if (stringCarrier) {
-            const parsed = parseCodexCarrierCommand(stringCarrier, options);
-            return parsed.ok ? parsed.argv : null;
-        }
         if (parseCodexCmdCarrierStringFailure(command, options))
             return null;
         return normalizeEvolcoreCommandArgv(outer);
     }
-    const stringCarrier = resolveCodexShellCarrierString(command);
-    if (!stringCarrier)
-        return null;
-    const parsed = parseCodexCarrierCommand(stringCarrier, options);
-    return parsed.ok ? normalizeEvolcoreCommandArgv(parsed.argv) : null;
+    return null;
 }
 /** Parse a Codex tool input while preserving safe syntax failure metadata. */
 export function parseCodexToolCommand(input, options = {}) {
@@ -1687,22 +1824,20 @@ export function parseCodexToolCommand(input, options = {}) {
             ? { ...parsed, argv: normalizeEvolcoreCommandArgv(parsed.argv) }
             : parsed;
     }
+    const stringCarrier = resolveCodexShellCarrierString(command);
+    if (stringCarrier) {
+        return parseCodexCarrierCommand(stringCarrier, { allowManagedTmpDir: true, ...options });
+    }
     const outer = parseLiteralShellCommand(command, { allowManagedTmpDir: true });
     if (outer.ok) {
         const carrier = resolveCodexShellCarrierArgv(outer.argv);
         if (carrier !== undefined) {
             return parseCodexCarrierCommand(carrier, { allowManagedTmpDir: true, ...options });
         }
-        const stringCarrier = resolveCodexShellCarrierString(command);
-        return stringCarrier
-            ? parseCodexCarrierCommand(stringCarrier, { allowManagedTmpDir: true, ...options })
-            : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true })
-                ?? { ...outer, argv: normalizeEvolcoreCommandArgv(outer.argv) };
+        return parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true })
+            ?? { ...outer, argv: normalizeEvolcoreCommandArgv(outer.argv) };
     }
-    const stringCarrier = resolveCodexShellCarrierString(command);
-    return stringCarrier
-        ? parseCodexCarrierCommand(stringCarrier, { allowManagedTmpDir: true, ...options })
-        : parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true }) ?? outer;
+    return parseCodexCmdCarrierStringFailure(command, { allowManagedTmpDir: true }) ?? outer;
 }
 function isApplyPatchExecutable(value) {
     const normalized = value.replaceAll('\\', '/').replace(/\/+$/u, '');
@@ -1715,7 +1850,7 @@ function normalizeApplyPatchPath(value) {
         return undefined;
     return normalized;
 }
-function parseApplyPatchDocument(source) {
+export function parseApplyPatchDocument(source) {
     const lines = source.replace(/\r\n?/gu, '\n').split('\n');
     while (lines.at(-1) === '')
         lines.pop();
@@ -2658,6 +2793,17 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
         });
         return { kind: 'composite', issue: parsed.ok ? 'shell-composition' : parsed.issue };
     }
+    const stringCarrier = resolveCodexShellCarrierString(stripped);
+    if (stringCarrier) {
+        const nested = parseCodexCarrierCommand(stringCarrier, parseOptions);
+        if (nested.ok && nested.argv[0] === 'ec')
+            return { kind: 'literal' };
+        if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
+            || (stringCarrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(stringCarrier.command)))) {
+            return { kind: 'composite', issue: nested.issue };
+        }
+        return { kind: 'none' };
+    }
     const literal = parseLiteralShellCommand(stripped, parseOptions);
     if (literal.ok) {
         if (normalizeEvolcoreCommandArgv(literal.argv)[0] === 'ec')
@@ -2672,16 +2818,6 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
                 return { kind: 'composite', issue: nested.issue };
             }
         }
-        const stringCarrier = resolveCodexShellCarrierString(stripped);
-        if (stringCarrier) {
-            const nested = parseCodexCarrierCommand(stringCarrier, parseOptions);
-            if (nested.ok && nested.argv[0] === 'ec')
-                return { kind: 'literal' };
-            if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
-                || (stringCarrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(stringCarrier.command)))) {
-                return { kind: 'composite', issue: nested.issue };
-            }
-        }
         const malformedCmdBody = extractCodexCmdCarrierBody(stripped);
         if (malformedCmdBody && looksLikeEcCommandBody(malformedCmdBody)) {
             const nested = parseLiteralShellCommand(malformedCmdBody, {
@@ -2694,17 +2830,6 @@ export function classifyEvolcoreShellCommand(command, options = {}) {
         }
         return { kind: 'none' };
     }
-    const stringCarrier = resolveCodexShellCarrierString(stripped);
-    if (stringCarrier) {
-        const nested = parseCodexCarrierCommand(stringCarrier, parseOptions);
-        if (nested.ok && nested.argv[0] === 'ec')
-            return { kind: 'literal' };
-        if (!nested.ok && (hasCarrierEcCommandPrefix(stringCarrier.command, stringCarrier.dialect)
-            || (stringCarrier.dialect === 'powershell' && hasPowerShellCredentialAssignment(stringCarrier.command)))) {
-            return { kind: 'composite', issue: nested.issue };
-        }
-        return { kind: 'none' };
-    }
     const malformedCmdBody = extractCodexCmdCarrierBody(stripped);
     if (malformedCmdBody && looksLikeEcCommandBody(malformedCmdBody)) {
         const nested = parseLiteralShellCommand(malformedCmdBody, {
@@ -3022,7 +3147,7 @@ export function describeProactiveSendCommandFailure(toolName, input, session) {
     const from = argv[3];
     const to = argv[4];
     const fullFormHint = `${prefix}缺少发送者与目标。完整形式为 ${expectedForm}；`
-        + '省略 from/to 仅在带 --thread 的跨话题发送中允许，普通回复也可用 ec ctl send "<正文>" 继承当前会话。';
+        + `省略 from/to 仅在带 --thread 的跨话题发送中允许，普通回复也可用 ec ctl send '<正文>' 继承当前会话。`;
     if (!from || from.startsWith('--')) {
         return fullFormHint;
     }
@@ -3030,7 +3155,7 @@ export function describeProactiveSendCommandFailure(toolName, input, session) {
         return looksLikeAid(from)
             ? fullFormHint
             : `${prefix}缺少发送者与目标（"${from}" 是正文而非 AID）。完整形式为 ${expectedForm}；`
-                + '省略 from/to 仅在带 --thread 的跨话题发送中允许，普通回复也可用 ec ctl send "<正文>" 继承当前会话。';
+                + `省略 from/to 仅在带 --thread 的跨话题发送中允许，普通回复也可用 ec ctl send '<正文>' 继承当前会话。`;
     }
     if (!looksLikeAid(from) || !looksLikeAid(to)) {
         return `${prefix}发送者/目标不是合法 AID（收到 from="${from}" to="${to}"）。完整形式为 ${expectedForm}。`;

package/dist/core/permission/protected-paths.js

@@ -938,7 +938,11 @@ export function lClassGrantIncludesProtectedPath(value, options = {}) {
         // A grant covering an Agent root also covers its L-class configuration.
         if (segments.length <= 2)
             return true;
-        return ['config.json', 'contact.json', 'contact-operations.jsonl', 'relations', 'roles', 'triggers']
+        // relations/ 下的 L 类只有 relations/<peer>/config.json：只有范围是 relations/ 或
+        // relations/<peer> 本身时才覆盖它，更深的路径（如 relations/<peer>/memory/…）不会。
+        if (segments[2] === 'relations')
+            return segments.length <= 4;
+        return ['config.json', 'contact.json', 'contact-operations.jsonl', 'roles', 'triggers']
             .includes(segments[2]);
     }
     return false;

package/dist/core/permission/readonly-shell-query.js

@@ -3,7 +3,7 @@ import { parseLiteralShellArgv } from './ec-command-parser.js';
 const MAX_QUERY_LISTS = 8;
 const MAX_PIPELINE_STAGES = 3;
 const SUPPORTED_EXECUTABLES = new Set([
-    'echo', 'pwd', 'ls', 'cat', 'grep', 'rg', 'find', 'sed', 'head', 'sort', 'git', 'wc', 'stat', 'lstat', 'awk',
+    'echo', 'pwd', 'ls', 'cat', 'grep', 'rg', 'find', 'sed', 'head', 'tail', 'sort', 'git', 'wc', 'stat', 'lstat', 'awk',
     'bash', 'sh',
 ]);
 const FIND_MUTATING_PRIMARY_RE = /^-(?:delete|exec|execdir|ok|okdir|fprint|fprint0|fprintf|fls)$/;
@@ -447,6 +447,13 @@ function analyzeHead(args) {
     const parsed = parseOptionsAndPaths(args, new Set(['-c', '-n', '--bytes', '--lines']));
     return parsed?.paths.map(exact) ?? null;
 }
+function analyzeTail(args) {
+    // -f/--follow opens an indefinite watch loop — not a bounded read query.
+    if (args.some(a => a === '-f' || a === '--follow' || /^-[^-]*f/.test(a)))
+        return null;
+    const parsed = parseOptionsAndPaths(args, new Set(['-c', '-n', '--bytes', '--lines']));
+    return parsed?.paths.map(exact) ?? null;
+}
 function analyzeSort(args) {
     if (args.some(argument => /^(?:-o|-T)(?:.+|$)|^(?:--output|--compress-program|--temporary-directory|--files0-from)(?:=|$)/.test(argument))) {
         return null;
@@ -828,68 +835,95 @@ function analyzeCommand(argv) {
     const args = argv.slice(1);
     let pathOperands = null;
     let accessKind = 'content';
+    let purpose = 'unknown';
     switch (executable) {
         case 'echo':
             pathOperands = [];
+            purpose = 'passthrough';
             break;
         case 'pwd':
             pathOperands = args.every(argument => ['-L', '-P', '--help', '--version'].includes(argument)) ? [] : null;
+            purpose = 'passthrough';
             break;
         case 'ls':
             pathOperands = analyzeLs(args);
+            purpose = 'enumerate';
             break;
         case 'cat':
             pathOperands = analyzeCat(args);
+            purpose = 'content-read';
             break;
         case 'grep':
             pathOperands = analyzeGrep(args);
+            purpose = 'search';
             break;
         case 'rg':
             pathOperands = analyzeRg(args);
+            purpose = 'search';
             break;
         case 'find':
             pathOperands = analyzeFind(args);
+            purpose = 'enumerate';
             break;
         case 'sed':
             pathOperands = analyzeSed(args);
+            purpose = 'content-read';
             break;
         case 'head':
             pathOperands = analyzeHead(args);
+            purpose = 'content-read';
+            break;
+        case 'tail':
+            pathOperands = analyzeTail(args);
+            purpose = 'content-read';
             break;
         case 'sort':
             pathOperands = analyzeSort(args);
+            // sort 有路径参数时是文件读取，无路径参数时是纯 stdin 排序
+            purpose = 'stdin-transform';
             break;
         case 'git':
             pathOperands = analyzeGit(args);
+            purpose = 'vcs-query';
             break;
         case 'wc':
             pathOperands = analyzeWc(args);
+            // wc 有路径参数时是元数据读取，无路径参数时是纯 stdin 统计
+            purpose = 'metadata-read';
             break;
         case 'stat':
         case 'lstat':
             pathOperands = analyzeStat(args);
             accessKind = 'metadata';
+            purpose = 'metadata-read';
             break;
         case 'awk':
             pathOperands = analyzeAwk(args);
+            purpose = 'content-read';
             break;
         case 'bash':
         case 'sh':
             pathOperands = analyzeShellSyntaxCheck(args);
+            purpose = 'syntax-check';
             break;
     }
     if (!pathOperands)
         return null;
     if (['ls', 'find'].includes(executable))
         accessKind = 'enumerate';
+    // 无路径操作数的命令是纯 stdin→stdout 变换，可安全出现在管道任意位置。
+    // 对于 sort/wc/awk/grep/head/tail/sed：有路径参数时读文件，无路径参数时为 stdin 变换。
+    const stdinTransform = pathOperands.length === 0
+        && ['sort', 'wc', 'awk', 'grep', 'rg', 'head', 'tail', 'sed'].includes(executable);
+    // 修正 purpose：stdin 变换时统一标记，避免 'metadata-read'/'content-read' 歧义
+    const resolvedPurpose = stdinTransform ? 'stdin-transform' : purpose;
     return {
         command: {
             executable,
             argv,
             pathOperands,
-            // Keep the established IR shape for ordinary queries. Only metadata
-            // commands need an explicit action marker; content/enumeration are
-            // derived from their operands by policy consumers.
+            stdinTransform,
+            purpose: resolvedPurpose,
             ...(accessKind === 'metadata' ? { accessKind } : {}),
         },
     };
@@ -910,7 +944,11 @@ export function analyzeReadonlyShellQuery(command, options = {}) {
             if (!analyzed)
                 return { kind: 'unproven', reason: 'unsupported-command-or-option' };
             if (index > 0) {
-                if (!['head', 'sort', 'grep', 'wc'].includes(analyzed.command.executable)) {
+                // 管道后续段必须是纯 stdin→stdout 变换（stdinTransform=true 由 analyzeCommand 打标，
+                // 表示命令无 FS 路径操作数、只处理 stdin 流）。
+                // 黑名单规则已在 analyzeCommand 内部拦截（如 sort -o、tail -f 等），到这里的都是
+                // 白名单规则捞回后的安全命令，用标签判断而非硬编码可执行文件列表。
+                if (!analyzed.command.stdinTransform) {
                     return { kind: 'unproven', reason: 'unsupported-pipeline-filter' };
                 }
                 if (analyzed.command.pathOperands.length > 0) {