fix: 安全审计加固 / Harden the permission gate and runner

[hezhongtang]

中文

符号链接后跟 .. 时，原来的路径检查先做词法折叠，可能把实际落在执行副本之外的操作判成界内。模型审批又会读取执行端可修改的任务单原文件，使审批依据能在投递后改变。本 PR 按安全审计加固这些路径，并保护闸门的状态和应答通道。

改动

• 路径判界与闸门自保：逐段解析符号链接和 ..，同时检查原路径与词法归一路径；写类工具没有可判路径或解析失败时转人工。直接触碰本工具管控面、调用本工具 CLI 的 Bash/js 操作也转人工，保留默认 worktrees/ 与本会话执行副本的例外。
• 固定审批依据：入队时保存任务单快照，记录 SHA-256，审批只读并核验快照。缺失或被修改的快照不再作为任务单授权依据。
• 凭据与落盘保护：ZCode 子进程剔除已知宿主代理凭据环境变量；runs/ 树使用 0700、文件使用 0600；挂起内容按已知密钥值脱敏；原子写使用随机临时名和排他创建。
• 审批探针与解析：关闭 git 探针的 fsmonitor、钩子、外部 diff、textconv 和已知 filter 驱动；快筛只接受独立成词、没有相反标记的肯定结果，含糊结果继续慢判。
• 协议与终端输出：反向请求应答缓存在下一回合开始时清理；无 requestId 的请求按方法及参数全文哈希去重；终端控制字符转义，减少挂起内容被改写的风险。
• 文档与回归用例：同步行为合同、术语、D23 取舍、实测记录与用例数量；核对 App 3.14.4 的工具注册与 --deny，明确禁用工具的联网边界。

模型审批仍只产出“放行”或“转人工”；人工拒绝路径与仅允许一次的合同保持不变。

验证

• macOS / Node v26.5.0：npm test，765/765 通过，包括文档版本同步检查。使用 mock，不消耗 ZCode 额度。
• git diff --check 通过。
• 对照本机 ZCode App 3.14.4 源码核实工具注册、禁止列表与工作流开关；未为此发模型回合。
• 与上游 main（5c728fe）的 git merge-tree 检查无冲突。

已知边界

执行端与 runner 仍是同一个系统用户。自保检查只识别直白写法，不提供系统级隔离。--deny "WebFetch WebSearch" 只移除指定联网工具，Bash、js 和 MCP 工具仍可能联网。硬链接越界与子模块自身的 git filter 配置等限制已记录在 D23，未在本 PR 扩大处理范围。

联合参与

本次工作由 Opus5.5、GPT-Sol-6.1、GLM5.3 联合参与修复。

---

English

When a symbolic link is followed by .., the previous path check normalized the path before resolving links and could classify an operation outside the worktree as inside it. Model review also read the mutable task file, allowing its authorization basis to change after a send. This PR hardens these paths following the security audit and protects the gate's state and answer channel.

Changes

• Path boundaries and gate protection: resolve symbolic links and .. component by component, checking both the original and normalized paths. Missing write targets and resolution failures escalate to a human. Direct Bash/js references to the control plane or executor CLI also escalate, with exceptions for the default worktrees/ root and the current session's worktree.
• Frozen authorization basis: snapshot task files when queued, record SHA-256, and review only verified snapshots. Missing or modified snapshots are excluded from task-file authorization evidence.
• Credentials and persisted state: strip known host-agent credential variables from ZCode's environment; use 0700 directories and 0600 files for the run tree; redact known secret values from pending state; use randomized, exclusively created temporary files for atomic writes.
• Review probes and parsing: disable fsmonitor, hooks, external diff, textconv and known filter drivers in git probes. Fast screening accepts only standalone affirmative markers without contradictory markers; ambiguous output proceeds to slow review.
• Protocol and terminal output: clear settled reverse-request responses at the next turn boundary, deduplicate requests without requestId by method and a hash of the complete parameters, and escape terminal control characters.
• Documentation and regressions: update behavioral contracts, terminology, D23 decisions, verification notes and test counts. Check App 3.14.4 tool registration and --deny, documenting the network-access boundary.

Model review continues to return only allow or ask. Human denial and the allow-once contract remain unchanged.

Validation

• macOS / Node v26.5.0: npm test, 765/765 passing, including the documentation-version check. All tests use mocks and spend no ZCode tokens.
• git diff --check passed.
• Inspected the local ZCode App 3.14.4 source for tool registration, deny lists and workflow switches; no model turn was sent for this verification.
• git merge-tree found no conflicts with upstream main at 5c728fe.

Known boundaries

The executor and runner still share an OS user. Gate protection recognizes plain spellings and does not provide OS isolation. --deny "WebFetch WebSearch" removes the named tools; Bash, js and MCP tools may still access the network. Hard-link escapes and git filter configuration inside submodules remain documented limitations in D23.

Joint participation

This work was jointly carried out by Opus5.5, GPT-Sol-6.1, and GLM5.3.