evolcore 0.0.35 → 0.0.36

package/dist/core/permission/ec-command-parser.js

@@ -1,6 +1,29 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { isTrustedWindowsShellExecutable } from '../../utils/windows-shell-trust.js';
+export function parseJsonObjectArgument(raw, optionName = '--payload') {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? `: ${error.message}` : '';
+        throw new Error(`${optionName} must be valid JSON${detail}`);
+    }
+    if (typeof parsed === 'string') {
+        try {
+            parsed = JSON.parse(parsed);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? `: ${error.message}` : '';
+            throw new Error(`${optionName} JSON string must contain valid JSON${detail}`);
+        }
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`${optionName} must be a JSON object`);
+    }
+    return parsed;
+}
 function parseApplyPatchCommand(command, options = {}) {
     const input = command.trim();
     let commandText = input;
@@ -114,7 +137,8 @@ export function parseShellApplyPatchInvocation(input, options = {}, parsedArgv)
     else {
         addCandidate(rawCommand);
     }
-    addCandidate(carrier?.command);
+    if (!carrier?.parseFailure)
+        addCandidate(carrier?.command);
     if (parsedArgv && argvUsesShellApplyPatch(parsedArgv)) {
         return parseApplyPatchArgv(parsedArgv);
     }
@@ -641,15 +665,68 @@ function hasCarrierEcCommandPrefix(command, dialect) {
 export function normalizeEvolcoreCommandArgv(argv) {
     if (argv.length === 0)
         return [];
-    const executable = argv[0];
+    const materialized = materializeEvolcoreCmdShimArgv(argv);
+    const executable = materialized[0];
     if (typeof executable === 'string' && EVOLCORE_EXECUTABLE_ALIASES.has(executable.toLowerCase())) {
-        return ['ec', ...argv.slice(1)];
+        return ['ec', ...materialized.slice(1)];
     }
-    if (typeof executable === 'string' && isNodeExecutable(executable) && argv.length >= 2
-        && typeof argv[1] === 'string' && normalizeNodeWrapperPath(argv[1])) {
-        return ['ec', ...argv.slice(2)];
+    if (typeof executable === 'string' && isNodeExecutable(executable) && materialized.length >= 2
+        && typeof materialized[1] === 'string' && normalizeNodeWrapperPath(materialized[1])) {
+        return ['ec', ...materialized.slice(2)];
+    }
+    return materialized;
+}
+/**
+ * Materialize the argv that an npm `ec.cmd` shim gives to Node.
+ *
+ * PowerShell first produces an argv for the batch file and the shim then
+ * expands `%*` into a command line before starting Node.  That second Windows
+ * command-line parse consumes an even half of each backslash run before a
+ * quote; an odd run leaves a literal quote.  JSON commonly arrives as
+ * `{\"key\":\"value\"}` at this boundary, while Node actually receives
+ * `{\"key\":\"value\"}` with the escaping backslashes removed.  The
+ * approval hash must describe the latter, because that is what the CLI uses
+ * when it authenticates the IPC request.
+ *
+ * This is deliberately limited to the trusted EC batch entrypoint.  It is
+ * not a general cmd.exe parser and does not authorize shell composition.
+ */
+function materializeEvolcoreCmdShimArg(value) {
+    let result = '';
+    let backslashes = 0;
+    const flushBackslashes = (count = backslashes) => {
+        if (count > 0)
+            result += '\\'.repeat(count);
+        backslashes = 0;
+    };
+    for (const char of value) {
+        if (char === '\\') {
+            backslashes++;
+            continue;
+        }
+        if (char === '"') {
+            result += '\\'.repeat(Math.floor(backslashes / 2));
+            if (backslashes % 2 === 1)
+                result += '"';
+            backslashes = 0;
+            continue;
+        }
+        flushBackslashes();
+        result += char;
     }
-    return [...argv];
+    flushBackslashes();
+    return result;
+}
+function isEvolcoreCmdShimExecutable(value) {
+    if (!value)
+        return false;
+    const normalized = value.replaceAll('\\', '/').toLowerCase();
+    return normalized === 'ec.cmd' || normalized.endsWith('/ec.cmd');
+}
+function materializeEvolcoreCmdShimArgv(argv) {
+    if (!isEvolcoreCmdShimExecutable(argv[0]))
+        return [...argv];
+    return [argv[0], ...argv.slice(1).map(materializeEvolcoreCmdShimArg)];
 }
 const INLINE_TEXT_FLAGS = {
     agentNew: new Set(['--description', '--persona-text', '--handoff']),
@@ -669,6 +746,7 @@ const MESSAGE_POSITIONAL_FLAGS = new Set([
     '--file', '--payload', '--as', '--content-type', '--text', '--transcript',
     '--thread', '--title', '--description', '--text-from-file',
     '--handoff-context', '--aun-path', '--app', '--format', '--encrypt', '--no-encrypt',
+    '--return', '--timeout',
 ]);
 /** Decode the EC inline text contract exactly once, after shell parsing. */
 export function decodeEvolcoreInlineText(value) {
@@ -980,6 +1058,8 @@ export function parseCodexCarrierCommand(carrier, options = {}) {
             return parseFailure('untrusted-shell', carrier.command, 0, 0, carrier.dialect);
         }
     }
+    if (carrier.parseFailure)
+        return carrier.parseFailure;
     const unwrapped = carrier.dialect === 'powershell'
         ? unwrapPowerShellCredentialPrefix(carrier.command)
         : { kind: 'none', command: carrier.command };
@@ -1012,9 +1092,10 @@ export function parseCodexCarrierCommand(carrier, options = {}) {
                 return parseFailure('shell-composition', unwrapped.command, 0, 0, carrier.dialect);
             }
             const bodyArgv = materialized.argv.slice(executeIndex + 1);
-            const materializedBody = bodyArgv.length === 1
+            const parsedBody = bodyArgv.length === 1
                 ? parseLiteralShellCommand(bodyArgv[0], { ...options, dialect: 'cmd' })
                 : { ok: true, argv: normalizeEvolcoreCommandArgv(bodyArgv) };
+            const materializedBody = parsedBody;
             if (!materializedBody.ok
                 || materializedBody.argv.length !== nested.argv.length
                 || materializedBody.argv.some((value, index) => value !== nested.argv[index])) {
@@ -1452,21 +1533,27 @@ function resolveCodexPowerShellCarrierString(command) {
 /** Resolve a POSIX shell carrier when app-server provides only a string. */
 function resolveCodexPosixShellCarrierString(command) {
     const input = trimShellSpacing(command);
+    const parsed = parseLiteralShellCommand(input);
+    if (parsed.ok) {
+        const carrier = resolveCodexShellCarrierArgv(parsed.argv);
+        if (carrier?.dialect === 'posix')
+            return carrier;
+    }
     const match = input.match(/^(?:"([^"]+)"|(\S+))\s+(-lc|-c)\s+(.+)$/s);
     if (!match)
         return undefined;
     const executable = match[1] ?? match[2];
     if (!isCodexPosixShellExecutable(executable))
         return undefined;
-    // A string-form carrier has one additional command-line quoting layer. Strip
-    // only the outer pair; quotes belonging to the nested command remain intact.
-    let nested = match[4].trim();
-    if (nested.length >= 2
-        && ((nested.startsWith('"') && nested.endsWith('"'))
-            || (nested.startsWith("'") && nested.endsWith("'")))) {
-        nested = nested.slice(1, -1);
-    }
-    return nested ? { command: nested, dialect: 'posix', executable } : undefined;
+    const nested = match[4].trim().replace(/^['"]/, '');
+    return {
+        command: nested,
+        dialect: 'posix',
+        executable,
+        parseFailure: parsed.ok
+            ? parseFailure('shell-composition', input, 0, 0, 'posix')
+            : parsed,
+    };
 }
 export function resolveCodexShellCarrierString(command) {
     return resolveCodexCmdCarrierString(command)
@@ -2424,16 +2511,40 @@ export function parseCodexExecToolCommand(input) {
     }
     return decoded;
 }
+/**
+ * parseCodexToolCommand 只接受单条字面量调用；`cd <dir> && ec …` 和 `ec … | <filter>`
+ * 包裹的发送命令会被判为 shell-composition。classifyEvolcoreShellCommand 已对这两种
+ * 复合形态做了安全边界校验，复用它提取的 ec argv 让下游发送校验看到和裸调用一致的字面量。
+ */
+function classifyCompositeProactiveSend(commandText, options) {
+    const classified = classifyEvolcoreShellCommand(commandText, options);
+    if (classified.kind === 'cd-prefixed' || classified.kind === 'bounded-output') {
+        const argv = normalizeEvolcoreCommandArgv(classified.command.argv);
+        if (argv[0] === 'ec')
+            return { ok: true, argv };
+    }
+    return null;
+}
 function parseProactiveToolCommand(toolName, input) {
     const options = {
         verifyShellExecutable: process.platform === 'win32',
     };
-    if (toolName === 'Bash' || toolName === 'Shell')
-        return parseCodexToolCommand(input, options);
+    if (toolName === 'Bash' || toolName === 'Shell') {
+        const literal = parseCodexToolCommand(input, options);
+        if (literal.ok)
+            return literal;
+        const commandText = typeof input.command === 'string' ? input.command : '';
+        return commandText ? (classifyCompositeProactiveSend(commandText, options) ?? literal) : literal;
+    }
     if (toolName !== 'exec')
         return null;
     const command = parseCodexExecToolCommand(input);
-    return command ? parseCodexToolCommand({ command }, options) : null;
+    if (!command)
+        return null;
+    const literal = parseCodexToolCommand({ command }, options);
+    if (literal.ok)
+        return literal;
+    return classifyCompositeProactiveSend(command, options) ?? literal;
 }
 function scanBoundedOutputOperators(command) {
     const operators = [];
@@ -2888,7 +2999,7 @@ const PROACTIVE_SEND_VALUE_FLAGS = new Set([
     '--format', '--app', '--file', '--text-from-file', '--link', '--payload',
     '--title', '--description', '--text', '--transcript', '--as',
     '--content-type', '--mention', '--aun-path', '--thread', '--handoff-context',
-    '--check-every', '--trigger-prompt',
+    '--check-every', '--trigger-prompt', '--return', '--timeout',
 ]);
 const PROACTIVE_SEND_BOOLEAN_FLAGS = new Set([
     '--encrypt', '--no-encrypt', '--mention-all',
@@ -3019,8 +3130,8 @@ function hasExecutableProactiveSendPayload(argv, scope) {
     }
     if (modes.has('payload')) {
         try {
-            const payload = JSON.parse(modes.get('payload'));
-            return !!payload && typeof payload === 'object' && !Array.isArray(payload);
+            parseJsonObjectArgument(modes.get('payload'));
+            return true;
         }
         catch {
             return false;
@@ -3134,8 +3245,10 @@ export function describeProactiveSendCommandFailure(toolName, input, session) {
         + ' "<正文>"';
     // 带 --thread 的发送走话题路由校验，允许省略 from/to；走到这里说明话题本身没解析通过。
     if (sendOptionValue(argv, '--thread')) {
-        return `${prefix}带 --thread 的跨话题发送未通过校验——话题必须已存在于本端索引，from（若给出）必须是本人，`
-            + `to（若给出）必须是该话题对端，且需携带 --check-every。可用 ec thread list <对方AID> 确认话题。`;
+        return `${prefix}带 --thread 的跨话题发送未通过校验——话题必须已存在于本端：话题写裸 id，`
+            + `主话题写 main:<aidA>:<aidB>（两端之一必须是本端）。from（若给出）必须是本人，`
+            + `to（若给出）必须是该话题对端，且需携带 --check-every。`
+            + `主话题 id 只在本端之间有效，不要转发给别人使用。可用 ec thread list <对方AID> 取得可用值。`;
     }
     // 私聊/群聊用错了 scope。
     if (session?.chatType && (session.chatType === 'group') !== (scope === 'group')) {

package/dist/core/permission/filesystem-approval-scope.js

@@ -0,0 +1,141 @@
+import fs from 'fs';
+import path from 'path';
+import { isSameOrDescendant, resolveProtectedCandidate } from './protected-paths.js';
+function literalPath(value, cwd) {
+    if (typeof value !== 'string' || !value.trim() || /[\0\r\n*?\[\]{}$`]/.test(value))
+        return undefined;
+    const canonical = resolveProtectedCandidate(value, cwd);
+    // Broad convenience grants never represent a filesystem/drive root.
+    if (path.dirname(canonical) === canonical)
+        return undefined;
+    return process.platform === 'win32' ? canonical.toLowerCase() : canonical;
+}
+export function fileChangeApprovalScope(rawPaths, cwd, grantRoot) {
+    // A grantRoot does not replace concrete targets (notably move destinations).
+    const candidates = grantRoot ? [grantRoot, ...rawPaths] : rawPaths;
+    if (candidates.length === 0)
+        return undefined;
+    const paths = candidates.map(candidate => literalPath(candidate, cwd));
+    if (paths.some(candidate => !candidate))
+        return undefined;
+    const canonical = [...new Set(paths)].sort();
+    const root = grantRoot ? literalPath(grantRoot, cwd) : undefined;
+    const directories = root
+        ? canonical.every(candidate => isSameOrDescendant(candidate, root)) ? [root] : []
+        : [...new Set(canonical.map(candidate => path.dirname(candidate)))];
+    return {
+        targets: canonical.map(candidate => ({ path: candidate, access: 'write' })),
+        ...(directories.length === 1 && path.dirname(directories[0]) !== directories[0]
+            ? { directory: directories[0] } : {}),
+        access: 'write',
+    };
+}
+/**
+ * Parse only proven, filesystem-only capabilities. Commands, network, globs,
+ * root aliases, unknown fields and future schemas retain exact-input approval.
+ */
+export function permissionApprovalScope(input, cwd, workspace) {
+    if (Object.keys(input).some(key => !['permissions', 'cwd', 'reason'].includes(key)))
+        return undefined;
+    const profile = input.permissions;
+    if (!profile || typeof profile !== 'object' || Array.isArray(profile))
+        return undefined;
+    const record = profile;
+    if (Object.keys(record).length !== 1)
+        return undefined;
+    const filesystem = record.fileSystem ?? record.filesystem;
+    if (!filesystem || typeof filesystem !== 'object' || Array.isArray(filesystem))
+        return undefined;
+    const targets = [];
+    const add = (value, access) => {
+        let candidate = value;
+        let base = cwd;
+        if (value && typeof value === 'object' && !Array.isArray(value)) {
+            const spec = value;
+            if (spec.type === 'special' && spec.value && typeof spec.value === 'object') {
+                const special = spec.value;
+                if (special.kind !== 'project_roots'
+                    || Object.keys(spec).some(key => key !== 'type' && key !== 'value')
+                    || Object.keys(special).some(key => key !== 'kind' && key !== 'subpath'))
+                    return false;
+                candidate = special.subpath ?? '.';
+                base = workspace;
+            }
+            else if (Object.keys(spec).length === 1 && (typeof spec.path === 'string' || typeof spec.pattern === 'string')) {
+                candidate = spec.path ?? spec.pattern;
+            }
+            else
+                return false;
+        }
+        if (typeof candidate === 'string' && candidate.startsWith(':'))
+            return false;
+        const canonical = literalPath(candidate, base);
+        if (!canonical)
+            return false;
+        targets.push({ path: canonical, access });
+        return true;
+    };
+    for (const [key, value] of Object.entries(filesystem)) {
+        if (key === 'read' || key === 'write') {
+            if (!Array.isArray(value) || !value.every(candidate => add(candidate, key)))
+                return undefined;
+        }
+        else if (key === 'entries') {
+            if (!Array.isArray(value))
+                return undefined;
+            for (const entry of value) {
+                if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+                    return undefined;
+                const rule = entry;
+                if (Object.keys(rule).some(field => field !== 'access' && field !== 'path'))
+                    return undefined;
+                if (rule.access === 'deny')
+                    continue;
+                if ((rule.access !== 'read' && rule.access !== 'write') || !add(rule.path, rule.access))
+                    return undefined;
+            }
+        }
+        else if (value === 'read' || value === 'write') {
+            if (!add(key, value))
+                return undefined;
+        }
+        else if (value !== 'deny')
+            return undefined;
+    }
+    if (targets.length === 0)
+        return undefined;
+    const directories = [...new Set(targets.map(target => {
+            try {
+                if (fs.statSync(target.path).isDirectory())
+                    return target.path;
+            }
+            catch { }
+            return path.dirname(target.path);
+        }))];
+    return {
+        targets,
+        ...(directories.length === 1 && path.dirname(directories[0]) !== directories[0]
+            ? { directory: directories[0] } : {}),
+        access: targets.some(target => target.access === 'write') ? 'write' : 'read',
+    };
+}
+export function filesystemScopeContains(scope, requested) {
+    // Re-resolve on every use, including missing/new-file ancestors. A directory
+    // replaced with a symlink/junction cannot redirect an existing grant.
+    if (scope.directory && literalPath(scope.directory, scope.directory) !== scope.directory)
+        return false;
+    return requested.targets.every(target => {
+        if (scope.access !== 'write' && target.access === 'write')
+            return false;
+        if (scope.directory && !isSameOrDescendant(target.path, scope.directory))
+            return false;
+        // Do not silently reuse a broad grant for hard-linked file aliases.
+        try {
+            const stat = fs.statSync(target.path);
+            if (stat.isFile() && stat.nlink > 1)
+                return false;
+        }
+        catch { }
+        return true;
+    });
+}

package/dist/core/permission/protected-paths.js

@@ -1,6 +1,6 @@
 import fs from 'fs';
 import path from 'path';
-import { resolveRoot } from '../../paths.js';
+import { resolveInstanceSocketPath, resolveRoot } from '../../paths.js';
 import { isValidAid } from '../../aun/aid/identity.js';
 const H_CLASS_RELATIVE_PATTERNS = [
     // These are true secret or daemon-owned roots. Agent-owned content is not
@@ -11,6 +11,7 @@ const H_CLASS_RELATIVE_PATTERNS = [
     /^CA(?:\/|$)/,
     /^\.device_id$/,
     /^\.env$/,
+    /^providers\.json(?:_|__|\.lock(?:\..*)?)?$/,
     /^\.seed(?:\.|$)/,
     /^\.migrated-/,
     /^\.lock$/,
@@ -19,6 +20,7 @@ const H_CLASS_RELATIVE_PATTERNS = [
     /^agents\/[^/]+\/data\/(?:.*\/)?(?:context-tokens|menu-tokens)\.json(?:_|__|\.tmp-.*)?$/,
 ];
 const H_CLASS_REFERENCE_PATTERNS = [
+    /(?:^|[^A-Za-z0-9_.-])providers\.json(?:_|__|\.lock(?:\.[^/\\\s"']*)?)?(?=$|[\s"';&|<>)},])/,
     /(?:^|[/\\\s"'=<>])data[\\/]/,
     /(?:^|[/\\\s"'=<>])(?:AIDs|aids)[\\/]/,
     /(?:^|[^A-Za-z0-9_.-])(?:\.device_id|\.env|\.seed(?:\.[^/\\\s"']*)?|\.migrated-[^/\\\s"']*|\.lock|daemon\.pid)(?=$|[\s"';&|<>)},])/,
@@ -146,6 +148,7 @@ function matchesHClassRelative(relative) {
     return false;
 }
 const SELF_AWARE_H_CLASS_RELATIVE_PATTERNS = [
+    /^providers\.json(?:_|__|\.lock(?:\..*)?)?$/,
     /^data(?:\/|$)/,
     /^(?:AIDs|aids)(?:\/|$)/,
     /^CA(?:\/|$)/,
@@ -873,6 +876,16 @@ export function buildCodexProtectedFilesystemRules(root = resolveRoot(), options
         ...buildCodexHClassFilesystemRules(root, hClassOptions),
         ...lClassRules,
     }, platform);
+    if (platform === 'linux' && options.outerHClassGuard) {
+        const dataDirectory = path.join(resolveThroughExistingAncestor(root), 'data');
+        const socketPath = resolveThroughExistingAncestor(resolveInstanceSocketPath(root));
+        if (filesystem[dataDirectory] === 'deny'
+            && isSameOrDescendant(socketPath, dataDirectory)
+            && getExistingHClassMaskTargets(root, options).some(target => target.path === dataDirectory && target.kind === 'directory')) {
+            filesystem[dataDirectory] = 'read';
+            delete filesystem[dataDirectory + '/**'];
+        }
+    }
     assertWindowsCodexFilesystemRuleBudget(filesystem, platform);
     return filesystem;
 }