evolcore 0.0.35 → 0.0.37

package/dist/core/permission/sandbox-runtime.js

@@ -1,14 +1,18 @@
 import fs from 'fs';
 import path from 'path';
+import { execFileSync } from 'node:child_process';
 import { resolveCommandPath } from '../../utils/cross-platform.js';
 import { getExistingHClassMaskTargets, getExistingRelationAttachmentDirs, getExistingLClassReadOnlyTargets, isSameOrDescendant, } from './protected-paths.js';
 import { resolveInstanceSocketPath, resolveRoot } from '../../paths.js';
-let cachedBubblewrapPath;
+import { MAIN_CLI_BIN } from '../../product.js';
 let sandboxInitializationCircuit;
 const sessionSandboxInitializationCircuits = new Map();
 let sandboxCircuitNoticeAt = 0;
 let sandboxInitializationFailureCounters = emptySandboxInitializationFailureCounters();
 export const SANDBOX_INITIALIZATION_FAILED = 'sandbox_initialization_failed';
+export const SANDBOX_DEPENDENCIES_MISSING = 'sandbox_dependencies_missing';
+export const CODEX_SANDBOX_USER_NAMESPACE_UNAVAILABLE = 'codex_sandbox_userns_unavailable';
+export const CODEX_SANDBOX_USER_NAMESPACE_DISABLED_BY_APPARMOR = 'codex_sandbox_userns_disabled_by_apparmor';
 export const SANDBOX_INITIALIZATION_COOLDOWN_MS = 5 * 60 * 1000;
 export const SANDBOX_CIRCUIT_NOTICE_INTERVAL_MS = 60 * 1000;
 function emptySandboxInitializationFailureCounters() {
@@ -26,7 +30,7 @@ function sandboxInitializationFailureKind(text) {
         return 'gid_map';
     if (/\bseccomp\b/i.test(text))
         return 'seccomp';
-    if (/user namespace/i.test(text))
+    if (isCodexSandboxUserNamespaceFailure(text))
         return 'user_namespace';
     if (/\b(?:bwrap|bubblewrap)\b/i.test(text))
         return 'bubblewrap';
@@ -101,13 +105,34 @@ export function isSandboxInitializationFailure(error, stderr = []) {
         .join('\n')
         .toLowerCase();
     return text.includes(SANDBOX_INITIALIZATION_FAILED)
+        || (text.includes('sandbox required but unavailable') && !isClaudeSandboxDependencyFailure(text))
         || /fs sandbox helper failed(?: with status)?\b/.test(text)
         || /(?:apply-seccomp|seccomp)[\s\S]*(?:uid_map|gid_map|operation not permitted)/.test(text)
         || /(?:uid_map|gid_map)[\s\S]*(?:operation not permitted|permission denied)/.test(text)
-        || /user namespace[\s\S]*(?:not permitted|unavailable|failed)/.test(text)
+        || isCodexSandboxUserNamespaceFailure(text)
         || /bubblewrap[\s\S]*namespace[\s\S]*(?:failed|not permitted|permission denied)/.test(text)
         || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot|unable to)[\s\S]*(?:bind|mount|mount table)/.test(text)
-        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot) create (?:file|directory) at [^\n]+: read-only file system/.test(text);
+        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot) create (?:file|directory) at [^\n]+: read-only file system/.test(text)
+        || /(?:^|\n)\s*bwrap:\s*(?:can't|cannot) mkdir parents for [^\n]+: read-only file system/.test(text);
+}
+export function isCodexSandboxUserNamespaceFailure(error) {
+    const record = error && typeof error === 'object'
+        ? error
+        : undefined;
+    const stderr = Array.isArray(record?.stderr)
+        ? record.stderr.filter((line) => typeof line === 'string').join('\n')
+        : typeof record?.stderr === 'string' ? record.stderr : '';
+    const text = record
+        ? `${String(record.code ?? '')}\n${String(record.message ?? '')}\n${stderr}`
+        : String(error ?? '');
+    const lower = text.toLowerCase();
+    return lower.includes(CODEX_SANDBOX_USER_NAMESPACE_UNAVAILABLE)
+        || lower.includes(CODEX_SANDBOX_USER_NAMESPACE_DISABLED_BY_APPARMOR)
+        || /apparmor_restrict_unprivileged_userns\s*=\s*1/i.test(text)
+        || /no permissions to create new namespace/i.test(text)
+        || /(?:new )?namespace[^\n]*(?:operation not permitted|permission denied)/i.test(text)
+        || /non-privileged user namespaces?/i.test(text)
+        || /user namespace[\s\S]*(?:not permitted|unavailable|failed|permission denied)/i.test(text);
 }
 export function createSandboxInitializationError(error, stderr = []) {
     if (error instanceof Error
@@ -177,10 +202,10 @@ function isExecutableFile(candidate) {
         return false;
     }
 }
-function codexBundledBubblewrap() {
+function codexBundledBubblewrap(env) {
     if (process.platform !== 'linux')
         return undefined;
-    const codexPath = resolveCommandPath('codex');
+    const codexPath = resolveCommandPath('codex', env);
     if (!codexPath)
         return undefined;
     let resolvedCodexPath = codexPath;
@@ -199,21 +224,150 @@ function codexBundledBubblewrap() {
     const platformPackage = process.arch === 'arm64' ? 'codex-linux-arm64' : 'codex-linux-x64';
     return path.join(packageRoot, 'node_modules', '@openai', platformPackage, 'vendor', target, 'codex-resources', 'bwrap');
 }
-export function resolveBubblewrapPath() {
-    if (cachedBubblewrapPath !== undefined)
-        return cachedBubblewrapPath ?? undefined;
-    if (process.platform !== 'linux') {
-        cachedBubblewrapPath = null;
+export function resolveBubblewrapPath(env = process.env) {
+    if (process.platform !== 'linux')
         return undefined;
-    }
     const candidates = [
-        process.env.EVOLCORE_BWRAP_PATH,
-        resolveCommandPath('bwrap') ?? undefined,
-        codexBundledBubblewrap(),
+        env.EVOLCORE_BWRAP_PATH,
+        resolveCommandPath('bwrap', env) ?? undefined,
+        codexBundledBubblewrap(env),
     ];
     const resolved = candidates.find(isExecutableFile);
-    cachedBubblewrapPath = resolved ?? null;
-    return resolved;
+    return resolved ? path.resolve(resolved) : undefined;
+}
+export function inspectClaudeSandboxDependencies(env = process.env, platform = process.platform) {
+    if (platform !== 'linux')
+        return { platform, status: 'not_applicable', missing: [] };
+    const bwrapPath = resolveBubblewrapPath(env);
+    const socatCandidate = resolveCommandPath('socat', env) ?? undefined;
+    const socatPath = isExecutableFile(socatCandidate) ? socatCandidate : undefined;
+    const missing = [...(bwrapPath ? [] : ['bubblewrap (bwrap)']), ...(socatPath ? [] : ['socat'])];
+    return { platform, status: missing.length ? 'missing' : 'ready', bwrapPath, socatPath, missing };
+}
+export function formatClaudeSandboxDependencies(check) {
+    if (check.status === 'not_applicable')
+        return `Claude Linux sandbox dependency check not applicable on ${check.platform}`;
+    if (check.status === 'ready')
+        return `Claude sandbox dependencies found: bwrap=${check.bwrapPath}; socat=${check.socatPath} (execution not verified)`;
+    return `Claude sandbox dependencies missing: ${check.missing.join(', ')}. `
+        + 'Sandbox-required sessions cannot execute; owner bypass may still work. '
+        + 'Install with your system package manager (Debian/Ubuntu: apt install bubblewrap socat; Fedora: dnf install bubblewrap socat), '
+        + `then run ${MAIN_CLI_BIN} diagnose in the service environment. EvolCore does not install OS packages or disable the sandbox automatically.`;
+}
+export function createClaudeSandboxDependencyError(check) {
+    return Object.assign(new Error(`${SANDBOX_DEPENDENCIES_MISSING}: ${formatClaudeSandboxDependencies(check)}`), {
+        code: SANDBOX_DEPENDENCIES_MISSING,
+    });
+}
+export function isClaudeSandboxDependencyFailure(error) {
+    const text = error && typeof error === 'object' && 'message' in error
+        ? String(error.message ?? '')
+        : String(error ?? '');
+    return text.includes(SANDBOX_DEPENDENCIES_MISSING)
+        || /sandbox[\s\S]*(?:dependencies are missing|dependencies missing|(?:socat|bwrap|bubblewrap) not installed)/i.test(text);
+}
+export function probeClaudeSandboxDependencies(check) {
+    if (check.status !== 'ready' || !check.bwrapPath)
+        return { ok: false, detail: formatClaudeSandboxDependencies(check) };
+    try {
+        execFileSync(check.bwrapPath, [
+            '--die-with-parent', '--new-session', '--unshare-pid', '--ro-bind', '/', '/',
+            '--proc', '/proc', '--dev', '/dev', '--', '/bin/true',
+        ], { timeout: 5_000, stdio: 'pipe' });
+        execFileSync(check.socatPath, ['-V'], { timeout: 5_000, stdio: 'pipe' });
+        return { ok: true, detail: 'Basic bwrap namespace and socat launch probes passed; full Claude sandbox policy is verified at execution.' };
+    }
+    catch (error) {
+        const failure = error;
+        return { ok: false, detail: `${SANDBOX_INITIALIZATION_FAILED}: ${failure.message}\n${failure.stderr?.toString() ?? ''}`.trim() };
+    }
+}
+function codexAppArmorRestrictsUnprivilegedUserns(platform) {
+    if (platform !== 'linux')
+        return undefined;
+    try {
+        return fs.readFileSync('/proc/sys/kernel/apparmor_restrict_unprivileged_userns', 'utf8').trim() === '1';
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Resolve the bwrap binary Codex is most likely to use for its inner sandbox. */
+export function resolveCodexSandboxBubblewrapPath(env = process.env) {
+    if (process.platform !== 'linux')
+        return undefined;
+    const bundled = codexBundledBubblewrap(env);
+    if (bundled && isExecutableFile(bundled))
+        return path.resolve(bundled);
+    return resolveBubblewrapPath(env);
+}
+export function inspectCodexSandboxAvailability(env = process.env, platform = process.platform) {
+    if (platform !== 'linux')
+        return { platform, status: 'not_applicable', missing: [] };
+    const bwrapPath = resolveCodexSandboxBubblewrapPath(env);
+    return {
+        platform,
+        status: bwrapPath ? 'ready' : 'missing',
+        bwrapPath,
+        apparmorRestrictsUnprivilegedUserns: codexAppArmorRestrictsUnprivilegedUserns(platform),
+        missing: bwrapPath ? [] : ['bubblewrap (bwrap)'],
+    };
+}
+export function formatCodexSandboxAvailability(check) {
+    if (check.status === 'not_applicable')
+        return `Codex Linux sandbox check not applicable on ${check.platform}`;
+    if (check.status === 'missing') {
+        return 'Codex Linux sandbox is unavailable: bubblewrap (bwrap) was not found; '
+            + 'install or provision the Codex sandbox runtime. EvolCore will not disable the sandbox automatically.';
+    }
+    const apparmor = check.apparmorRestrictsUnprivilegedUserns === true
+        ? ' AppArmor restricts unprivileged user namespaces on this host; the probe below confirms whether the active profile permits Codex.'
+        : '';
+    return `Codex Linux sandbox runtime found: bwrap=${check.bwrapPath}.${apparmor}`;
+}
+export function probeCodexSandboxAvailability(check) {
+    if (check.status !== 'ready' || !check.bwrapPath) {
+        return { ok: false, detail: formatCodexSandboxAvailability(check) };
+    }
+    try {
+        execFileSync(check.bwrapPath, [
+            '--die-with-parent', '--new-session', '--unshare-pid', '--ro-bind', '/', '/',
+            '--proc', '/proc', '--dev-bind', '/dev', '/dev', '--tmpfs', '/tmp',
+            '--', '/bin/true',
+        ], { timeout: 5_000, stdio: 'pipe' });
+        return { ok: true, detail: `Codex Linux sandbox user-namespace probe passed: bwrap=${check.bwrapPath}` };
+    }
+    catch (error) {
+        const failure = error;
+        const stderr = failure.stderr?.toString().trim();
+        const stdout = failure.stdout?.toString().trim();
+        const raw = stderr || stdout || failure.message.trim();
+        const apparmor = check.apparmorRestrictsUnprivilegedUserns === true
+            || /apparmor_restrict_unprivileged_userns\s*=\s*1|apparmor/i.test(raw);
+        if (isCodexSandboxUserNamespaceFailure(raw)) {
+            const code = apparmor
+                ? CODEX_SANDBOX_USER_NAMESPACE_DISABLED_BY_APPARMOR
+                : CODEX_SANDBOX_USER_NAMESPACE_UNAVAILABLE;
+            return {
+                ok: false,
+                kind: apparmor ? 'apparmor' : 'user_namespace',
+                detail: `${code}: ${raw}`,
+                raw,
+            };
+        }
+        return { ok: false, kind: 'bubblewrap', detail: `${SANDBOX_INITIALIZATION_FAILED}: ${raw}`, raw };
+    }
+}
+export function createCodexSandboxAvailabilityError(probe) {
+    const code = probe.kind === 'apparmor'
+        ? CODEX_SANDBOX_USER_NAMESPACE_DISABLED_BY_APPARMOR
+        : probe.kind === 'user_namespace'
+            ? CODEX_SANDBOX_USER_NAMESPACE_UNAVAILABLE
+            : SANDBOX_INITIALIZATION_FAILED;
+    return Object.assign(new Error(`${code}: ${probe.raw ?? probe.detail}`), {
+        code,
+        ...(probe.raw ? { raw: probe.raw } : {}),
+    });
 }
 export function prependExecutableDirectory(env, executablePath) {
     const currentPath = env.PATH ?? process.env.PATH ?? '';
@@ -713,7 +867,6 @@ export function buildBubblewrapCommand(executable, executableArgs, options) {
 }
 export function _resetSandboxRuntimeCache() {
     sessionSandboxInitializationCircuits.clear();
-    cachedBubblewrapPath = undefined;
     sandboxInitializationCircuit = undefined;
     sandboxCircuitNoticeAt = 0;
     sandboxInitializationFailureCounters = emptySandboxInitializationFailureCounters();

package/dist/core/permission/tool-policy.js

@@ -1,4 +1,5 @@
 import fs from 'fs';
+import { parseOwnershipCommand } from '../../aun/aid/ownership-operation.js';
 import path from 'path';
 import os from 'os';
 import { randomUUID } from 'crypto';
@@ -42,7 +43,7 @@ export function expandManagedTempPath(value, options = {}) {
     return substituteTmpDir(value, resolveManagedTempDir(options.env));
 }
 const WRITE_INTENT_RE = /(?:^|[\s;&|])(?:mkdir|mktemp|touch|tee|cp|mv|install|chmod|chown|ln|rm)(?:[\s;&|]|$)|(?:^|[\s])(?:\d>>?|>>?)\s*/i;
-const TEMP_TOKEN_RE = /(?:\$TMPDIR|\$\{TMPDIR\}|\/tmp(?:\/|$)|\/var\/tmp(?:\/|$)|\/dev\/shm(?:\/|$))[^\s'";&|<>)]*/g;
+const TEMP_TOKEN_RE = /(?:\$TMPDIR|\$\{TMPDIR\}|\/(?:[^\s'";&|<>)]*\/)?(?:tmp|var\/tmp|dev\/shm)(?:\/|$))[^\s'";&|<>)]*/g;
 function windowsTempRoots(options) {
     if (process.platform !== 'win32')
         return [];
@@ -2394,7 +2395,7 @@ export function evaluateToolPreflight(toolName, input, context) {
             : undefined;
         const stringShellCarrier = shellCarrier
             ?? (explicitCommandArgv ? undefined : resolveCodexShellCarrierString(command));
-        const wrappedCommand = stringShellCarrier?.command;
+        const wrappedCommand = stringShellCarrier?.parseFailure ? undefined : stringShellCarrier?.command;
         const policyCommand = wrappedCommand ?? commandForPolicy;
         if (context.sessionId && /^\s*(?:command\s+-v|which|type)\s+ec\s*$/i.test(policyCommand)) {
             return {
@@ -2553,7 +2554,17 @@ export function evaluateToolPreflight(toolName, input, context) {
             && ['request', 'bypass'].includes(context.permissionMode ?? '');
         const canUploadSelfAvatar = isSelfAvatarUpload
             && ['request', 'bypass'].includes(context.permissionMode ?? '');
+        let isManagedOwnership = false;
+        if (managedAidArgs?.[0] === 'bind') {
+            try {
+                const ownership = parseOwnershipCommand(managedAidArgs);
+                isManagedOwnership = ownership.action === 'status'
+                    || ['request', 'bypass'].includes(context.permissionMode ?? '');
+            }
+            catch { }
+        }
         const isAllowedManagedAidCommand = isManagedAidPublicRead
+            || isManagedOwnership
             || isSelfManagedAidShow
             || canPublishSelfAgentMd
             || canSetSelfAgentMd

package/dist/core/role/runtime-policy.js

@@ -2,7 +2,7 @@ import { getRoleDefinition } from '../../config/roles.js';
 import { PUBLIC_PERMISSION_MODES } from '../permission/mode.js';
 import { ConfigTarget, read } from '../../config/config-manager.js';
 import { resolvePrincipal } from '../../config/contact-book.js';
-import { loadDaemonConfig } from '../../config-store.js';
+import { getDaemonOwners, ownerResolver } from '../ownership/owner-resolver.js';
 import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
 const PERMISSION_MODE_AUTHORITY = {
     readonly: 0,
@@ -150,9 +150,8 @@ export function validateRuntimeStringFieldOverride(input) {
 export function isAgentFullAccessOwner(agentAid, principalId) {
     if (!principalId)
         return false;
-    const config = read(ConfigTarget.Agent, { self: agentAid }, { cache: false });
-    return config?.owners?.includes(principalId) === true
-        && loadDaemonConfig().owners?.includes(principalId) === true;
+    return ownerResolver.isOwner(agentAid, principalId)
+        && getDaemonOwners().includes(principalId);
 }
 export function agentFullAccessStatus(agentAid, principalId) {
     const config = read(ConfigTarget.Agent, { self: agentAid }, { cache: false });

package/dist/core/session/session-idle-monitor.js

@@ -2,6 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import { ConfigTarget, mutateConfig, read as readConfig } from '../../config/config-manager.js';
 import { formatPeerKey } from '../relation/peer-identity.js';
+import { isMainSession, isTopicSession, sessionTopicThreadId } from '../thread/topic-id.js';
 import { isSystemControlChannel } from '../system-channels.js';
 import { logger } from '../../utils/logger.js';
 import { atomicWriteJson } from './session-fs-store.js';
@@ -35,7 +36,7 @@ export function resolveSessionLoopTarget(session) {
     if (!session.selfAID || !peerId)
         return undefined;
     const peerKey = formatPeerKey(session.channelType || session.channel, peerId);
-    return { level: session.threadId ? 'topic-session' : 'relation-main', session, peerKey };
+    return { level: isTopicSession(session) ? 'topic-session' : 'relation-main', session, peerKey };
 }
 export function readSessionLoopConfig(target) {
     let value;
@@ -90,7 +91,7 @@ export async function resolveCurrentSessionLoopTarget(store, route) {
     const target = resolveSessionLoopTarget(session);
     if (!target || !route.selfAid || session.selfAID !== route.selfAid
         || session.channel !== route.channel || session.channelId !== route.channelId
-        || (session.threadId || '') !== (route.threadId || '')) {
+        || (sessionTopicThreadId(session) ?? '') !== (route.threadId || '')) {
         throw sessionLoopError('INVALID_CONTEXT', '当前会话路由或归属不匹配');
     }
     return target;
@@ -108,7 +109,7 @@ export function writeSessionLoopConfig(store, target, config) {
         return { ...target, session };
     }
     const active = store.getActiveSessionSync(target.session.channel, target.session.channelId);
-    if (!active || active.deletedAt || active.id !== target.session.id || active.threadId) {
+    if (!active || active.deletedAt || active.id !== target.session.id || isTopicSession(active)) {
         throw sessionLoopError('CONFLICT', '当前主会话已发生变化，请重新查询');
     }
     updateRelationSessionLoop(active, config);
@@ -430,6 +431,7 @@ export class SessionIdleMonitor {
         state.emitted = true;
         if (!this.persistState())
             return;
+        const topicThreadId = sessionTopicThreadId(session);
         this.options.eventBus.publish({
             type: 'session:idle',
             sessionId,
@@ -438,7 +440,7 @@ export class SessionIdleMonitor {
             channelName: session.channel,
             channelId: session.channelId,
             chatType: session.chatType,
-            ...(session.threadId ? { threadId: session.threadId } : {}),
+            ...(topicThreadId ? { threadId: topicThreadId } : {}),
             ...(session.metadata?.peerId || session.channelId ? { peerId: session.metadata?.peerId || session.channelId } : {}),
             ...(typeof state.encrypted === 'boolean'
                 ? { encrypted: state.encrypted }
@@ -491,12 +493,12 @@ export class SessionIdleMonitor {
     }
     isEligibleSession(session) {
         return !!resolveSessionLoopTarget(session)
-            && (!!session.threadId || !this.options.isCurrentMainSession || this.options.isCurrentMainSession(session));
+            && (isTopicSession(session) || !this.options.isCurrentMainSession || this.options.isCurrentMainSession(session));
     }
     async disarmMainSession(sessionId) {
         try {
             const session = await this.options.getSessionById(sessionId);
-            if (!session || session.threadId)
+            if (!session || isTopicSession(session))
                 return;
             this.clearTimers(sessionId);
             this.generations.set(sessionId, (this.generations.get(sessionId) ?? 0) + 1);
@@ -509,7 +511,7 @@ export class SessionIdleMonitor {
         try {
             const session = await this.options.getSessionById(sessionId);
             const state = this.sessions.get(sessionId);
-            if (!session || session.threadId || !state || !this.isEligibleSession(session))
+            if (!session || isTopicSession(session) || !state || !this.isEligibleSession(session))
                 return;
             this.clearTimers(sessionId);
             this.generations.set(sessionId, (this.generations.get(sessionId) ?? 0) + 1);
@@ -525,7 +527,7 @@ export class SessionIdleMonitor {
     async pruneInactiveMainSession(sessionId) {
         try {
             const session = await this.options.getSessionById(sessionId);
-            if (session && !session.threadId && !this.isEligibleSession(session))
+            if (session && isMainSession(session) && !this.isEligibleSession(session))
                 await this.disarmMainSession(sessionId);
         }
         catch (error) {