@evomap/evolver-core 2.0.0-beta.2 → 2.0.0-beta.22

package/dist/verify/sandboxedValidation.js

@@ -3,10 +3,119 @@
 // metachar rejection, node-eval-flag blocking, a scrubbed env, a SIGKILL timeout, and — where unprivileged
 // namespaces exist — no network + hidden home secrets, so a validation command cannot phone home / exfiltrate to
 // game the pass/fail. This is the "verifier outside the repo, untrusted caller" half the safety model relies on.
-import { existsSync } from 'node:fs';
-import { isAbsolute, resolve } from 'node:path';
-import { makeSandboxRunner, unshareNetAvailable } from './sandboxRunner.js';
-import { runValidation, validationScriptPath } from './validation.js';
+import { spawnSync } from 'node:child_process';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, realpathSync, rmSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { isolationCommand, makeSandboxRunner, sandboxResourceLimitsAvailable, unshareNetAvailable, } from './sandboxRunner.js';
+import { runValidation, tokenizeValidationCommand, validationScriptPath, } from './validation.js';
+let readOnlyIsolationAvailableCache;
+let readOnlyFilesystemIsolationAvailableCache;
+export function readOnlyFilesystemIsolationAvailable() {
+    if (process.platform !== 'linux')
+        return false;
+    if (readOnlyFilesystemIsolationAvailableCache !== undefined)
+        return readOnlyFilesystemIsolationAvailableCache;
+    const probeRoot = mkdtempSync('/var/tmp/evolver-isolation-probe-');
+    const probeHome = mkdtempSync('/var/tmp/evolver-isolation-home-');
+    const scratch = join(probeRoot, 'session');
+    const probeCwd = join(probeRoot, 'cwd');
+    try {
+        mkdirSync(scratch);
+        mkdirSync(probeCwd);
+        const probe = isolationCommand(process.execPath, ['--version'], {
+            noNetwork: true,
+            hideHomeSecrets: true,
+            readOnlyFilesystem: true,
+            writableTmpDir: scratch,
+            readOnlyRoot: probeCwd,
+            cwd: probeCwd,
+        });
+        readOnlyFilesystemIsolationAvailableCache = spawnSync(probe.cmd, probe.args, {
+            cwd: probeCwd,
+            env: {
+                HOME: process.env.HOME ?? probeHome,
+                PATH: process.env.PATH ?? '/usr/bin:/bin',
+            },
+            input: '\n',
+            timeout: 5_000,
+            stdio: ['pipe', 'ignore', 'ignore'],
+        }).status === 0;
+    }
+    catch {
+        readOnlyFilesystemIsolationAvailableCache = false;
+    }
+    finally {
+        rmSync(probeRoot, { recursive: true, force: true });
+        rmSync(probeHome, { recursive: true, force: true });
+    }
+    return readOnlyFilesystemIsolationAvailableCache;
+}
+export function readOnlyIsolationAvailable() {
+    if (process.platform !== 'linux')
+        return false;
+    if (readOnlyIsolationAvailableCache !== undefined)
+        return readOnlyIsolationAvailableCache;
+    readOnlyIsolationAvailableCache = sandboxResourceLimitsAvailable() && readOnlyFilesystemIsolationAvailable();
+    return readOnlyIsolationAvailableCache;
+}
+function validationReadOnlyRoot(cwd) {
+    let current = resolve(cwd);
+    while (true) {
+        if (existsSync(join(current, '.git')))
+            return current;
+        const parent = dirname(current);
+        if (parent === current)
+            return resolve(cwd);
+        current = parent;
+    }
+}
+function skippedCommand(cmd, script, reason) {
+    return { cmd, script, reason };
+}
+/**
+ * Validate the script target before it reaches the runner. The runner's mount namespace is read-only, not a chroot,
+ * so lexical containment alone is insufficient: a path inside the checkout may resolve through a symlink outside it.
+ * Symlink script entries are rejected outright, and the canonical target is checked immediately before execution.
+ */
+function classifyValidationScript(cmd, script, validationCwd, readOnlyRoot) {
+    if (isAbsolute(script)) {
+        return { ok: false, skipped: skippedCommand(cmd, script, 'script_outside_root') };
+    }
+    let candidate;
+    try {
+        candidate = resolve(validationCwd, script);
+    }
+    catch {
+        return { ok: false, skipped: skippedCommand(cmd, script, 'script_unresolvable') };
+    }
+    if (!pathIsWithin(readOnlyRoot, candidate)) {
+        return { ok: false, skipped: skippedCommand(cmd, script, 'script_outside_root') };
+    }
+    let metadata;
+    try {
+        metadata = lstatSync(candidate);
+    }
+    catch {
+        return { ok: false, skipped: skippedCommand(cmd, script, 'missing_script') };
+    }
+    if (metadata.isSymbolicLink()) {
+        return { ok: false, skipped: skippedCommand(cmd, script, 'script_symlink') };
+    }
+    if (!metadata.isFile()) {
+        return { ok: false, skipped: skippedCommand(cmd, script, 'script_unresolvable') };
+    }
+    let canonicalScript;
+    try {
+        canonicalScript = realpathSync(candidate);
+    }
+    catch {
+        return { ok: false, skipped: skippedCommand(cmd, script, 'script_unresolvable') };
+    }
+    if (!pathIsWithin(readOnlyRoot, canonicalScript)) {
+        return { ok: false, skipped: skippedCommand(cmd, script, 'script_outside_root') };
+    }
+    return { ok: true };
+}
 /**
  * Run validation commands in the hardened sandbox. Isolation (no-network + hidden home secrets) is requested only
  * when unprivileged namespaces are available; elsewhere (Windows/macOS) it degrades to the non-namespace hardening
@@ -15,42 +124,111 @@ import { runValidation, validationScriptPath } from './validation.js';
  * preserving prior behavior; note this differs from runValidation's own "no commands = not verified" stance.
  */
 export async function runSandboxedValidation(cmds, cwd, opts = {}) {
-    const isolated = (opts.unshareCheck ?? unshareNetAvailable)();
+    if (opts.signal?.aborted)
+        return { passed: false, cancelled: true, score: 0.2, results: [], skipped: [], isolated: false };
+    const isolationCheck = opts.unshareCheck ?? (opts.requireIsolation ? readOnlyIsolationAvailable : unshareNetAvailable);
+    const isolated = isolationCheck();
+    if (opts.requireIsolation && !isolated) {
+        return { passed: false, cancelled: opts.signal?.aborted === true, score: 0.2, results: [], skipped: [], isolated: false };
+    }
+    let validationCwd = resolve(cwd);
+    let readOnlyRoot = opts.readOnlyRoot ? resolve(opts.readOnlyRoot) : validationReadOnlyRoot(validationCwd);
+    // Canonicalize the validation root in every mode. Namespace isolation is an additional boundary, not a substitute
+    // for refusing an absolute, escaping, or symlinked script path; this also keeps the Windows/macOS path fail closed.
+    try {
+        validationCwd = realpathSync(validationCwd);
+        readOnlyRoot = realpathSync(readOnlyRoot);
+    }
+    catch {
+        return { passed: false, cancelled: opts.signal?.aborted === true, score: 0.2, results: [], skipped: [], isolated };
+    }
+    if (dirname(readOnlyRoot) === readOnlyRoot || !pathIsWithin(readOnlyRoot, validationCwd)) {
+        return { passed: false, cancelled: opts.signal?.aborted === true, score: 0.2, results: [], skipped: [], isolated };
+    }
     // ONLY a truly empty command set is a vacuous pass (nothing to verify). A non-empty set with blank entries is a
     // malformed plan, NOT a pass: blanks are kept (trimmed to '') so they fall outside the allowlist and fail, rather
     // than being silently dropped into a pass (Bugbot).
     if (cmds.length === 0)
-        return { passed: true, score: 0.95, results: [], skipped: [], isolated };
-    const runner = makeSandboxRunner({
-        cwd,
-        noNetwork: isolated,
-        hideHomeSecrets: isolated,
-        ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),
-        ...(opts.unshareCheck ? { unshareCheck: opts.unshareCheck } : {}),
-    });
+        return { passed: true, cancelled: false, score: 0.95, results: [], skipped: [], isolated };
     const list = cmds.map((c) => String(c ?? '').trim());
-    // Validation plans may reference repo-relative scripts that do not exist in this checkout; skip only those.
+    // Validation plans may reference repo-relative scripts that do not exist in this checkout; skip those, but never
+    // execute a script that is absolute, escapes the root, resolves through a symlink, or is not a regular file.
     const skipped = [];
     const runnable = [];
     for (const cmd of list) {
         const script = validationScriptPath(cmd);
-        if (script && !isAbsolute(script) && !existsSync(resolve(cwd, script))) {
-            skipped.push({ cmd, script, reason: 'missing_script' });
-            console.warn(`[Validation] Skipping validation command (script not in repoRoot): ${script}`);
-            continue;
+        if (script) {
+            const classification = classifyValidationScript(cmd, script, validationCwd, readOnlyRoot);
+            if (!classification.ok) {
+                skipped.push(classification.skipped);
+                if (classification.skipped.reason === 'missing_script') {
+                    console.warn(`[Validation] Skipping validation command (script not in repoRoot): ${script}`);
+                }
+                else {
+                    console.warn(`[Validation] Rejecting validation command (${classification.skipped.reason}): ${script}`);
+                }
+                continue;
+            }
         }
         runnable.push(cmd);
     }
     if (runnable.length === 0)
-        return { passed: false, score: 0.2, results: [], skipped, isolated };
-    const allowlist = [...new Set(runnable.map((c) => c.split(/\s+/)[0] ?? '').filter(Boolean))];
-    const { results, passed } = await runValidation({ commands: runnable.map((cmd) => ({ cmd })), allowlist }, runner);
-    const complete = skipped.length === 0;
+        return { passed: false, cancelled: opts.signal?.aborted === true, score: 0.2, results: [], skipped, isolated };
+    const scratch = isolated && opts.requireIsolation
+        ? mkdtempSync('/var/tmp/evolver-validation-')
+        : undefined;
+    const runner = makeSandboxRunner({
+        cwd: validationCwd,
+        noNetwork: isolated,
+        hideHomeSecrets: isolated,
+        readOnlyFilesystem: isolated && opts.requireIsolation,
+        resourceLimits: isolated && opts.requireIsolation,
+        writableTmpDir: scratch,
+        readOnlyRoot,
+        ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),
+        ...(opts.resourceGroupFactory ? { resourceGroupFactory: opts.resourceGroupFactory } : {}),
+        ...(opts.signal ? { signal: opts.signal } : {}),
+        unshareCheck: () => isolated,
+    });
+    // Re-check each script immediately before its spawn. The initial pass supplies precise skipped reasons, while
+    // this second gate closes the degraded-mode window where an earlier validator could replace a later path.
+    const guardedRunner = async (cmd, signal) => {
+        const script = validationScriptPath(cmd);
+        if (script) {
+            const classification = classifyValidationScript(cmd, script, validationCwd, readOnlyRoot);
+            if (!classification.ok) {
+                return {
+                    exitCode: 126,
+                    stdout: `[sandbox] rejected: ${classification.skipped.reason}: ${script}`,
+                };
+            }
+        }
+        return runner(cmd, signal);
+    };
+    const allowlist = [...new Set(runnable
+            .map((c) => tokenizeValidationCommand(c)?.[0] ?? '')
+            .filter(Boolean))];
+    let results;
+    let passed;
+    let cancelled;
+    try {
+        ({ results, passed, cancelled } = await runValidation({ commands: runnable.map((cmd) => ({ cmd })), allowlist }, guardedRunner, opts.signal));
+    }
+    finally {
+        if (scratch)
+            rmSync(scratch, { recursive: true, force: true });
+    }
+    const complete = skipped.length === 0 && !cancelled;
     return {
         passed: passed && complete,
+        cancelled,
         score: passed && complete ? 0.95 : 0.2,
         results,
         skipped,
         isolated,
     };
+}
+function pathIsWithin(root, target) {
+    const rel = relative(root, target);
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
 }

package/dist/verify/validation.d.ts

@@ -19,15 +19,35 @@ export interface RunOutput {
     exitCode: number;
     stdout: string;
 }
-export type CommandRunner = (cmd: string) => Promise<RunOutput> | RunOutput;
+export type CommandRunner = (cmd: string, signal?: AbortSignal) => Promise<RunOutput> | RunOutput;
 export declare const SHELL_METACHARS: RegExp;
+/**
+ * Parse one validation command without invoking a shell. Quotes group whitespace and backslash only escapes
+ * whitespace, quotes, or another backslash; no variable expansion or command substitution is performed.
+ * A null result means the command has an unterminated quote and must be rejected.
+ */
+export declare function tokenizeValidationCommand(command: string): string[] | null;
 export declare const BLOCKED_NODE_FLAGS: Set<string>;
 export declare function normalizeExecutableName(executable: string): string;
 export declare function isNodeExecutable(executable: string): boolean;
 export declare function nodeFlagViolation(executable: string, args: readonly string[]): string | null;
+export type NodeValidationInvocation = {
+    kind: 'script';
+    script: string;
+} | {
+    kind: 'safe_no_script';
+} | {
+    kind: 'invalid';
+    option?: string;
+};
+/**
+ * 将 Node 命令限制为明确的脚本位置，防止带参数的选项吞掉下一个 token 后绕过脚本路径检查。
+ * 验证只需要普通脚本、语法检查，以及兼容旧 Gene 的 version/help 身份检查；其他前置选项默认拒绝。
+ */
+export declare function classifyNodeValidationInvocation(executable: string, args: readonly string[]): NodeValidationInvocation;
 /** 命令首 token(可执行名)是否在项目声明的 allowlist 内. */
 export declare function isAllowed(cmd: string, allowlist: readonly string[]): boolean;
-/** Extract the local script targeted by `node <script> ...`, or null for non-script node commands. */
+/** Extract the unambiguous script targeted by `node <script> ...`, or null for non-script/unsupported commands. */
 export declare function validationScriptPath(cmd: string): string | null;
 /** stdout 摘要 = 首行 + 末行(去 canary.js 隐形约定: 不找魔法字符串, 只留可读摘要). */
 export declare function summarizeStdout(stdout: string): string;
@@ -35,7 +55,18 @@ export declare function summarizeStdout(stdout: string): string;
  * 跑校验(M4A-4). 判价值 = **exit code + stdout 摘要**, 不依赖 canary.js 魔法字符串(批注#22).
  * 不在 allowlist 的命令 auto-deny(不执行, allowed=false), 守无人值守安全.
  */
-export declare function runValidation(plan: ValidationPlan, run: CommandRunner): Promise<{
+export declare function runValidation(plan: ValidationPlan, run: CommandRunner, signal?: AbortSignal): Promise<{
     results: ValidationResult[];
     passed: boolean;
-}>;
+    cancelled: boolean;
+}>;
+/**
+ * 检查验证命令是否安全可作为 Gene.validation 条目使用（忠实移植 v1 policyCheck.isValidationCommandAllowed）。
+ * Gene 验证命令只允许 `node …` 形式，不允许非 node 命令（如 pnpm/npm/echo 等）。
+ * 安全条件：
+ * 1. 必须以 `node ` 开头
+ * 2. 不包含命令替换（` 或 $(）
+ * 3. 不包含 shell 元字符（引号外）
+ * 4. 不包含被阻止的 node 标志（-e/--eval/--print 等）
+ */
+export declare function isValidationCommandAllowed(cmd: string): boolean;

package/dist/verify/validation.js

@@ -1,6 +1,70 @@
 // With shell:false these are passed literally (harmless), but their presence means an injection attempt
 // or a command that wrongly assumes a shell (e.g. `a && b`) — reject loudly so it is split, not silently mis-run.
 export const SHELL_METACHARS = /[;&|`$<>\n\r]/;
+/**
+ * Parse one validation command without invoking a shell. Quotes group whitespace and backslash only escapes
+ * whitespace, quotes, or another backslash; no variable expansion or command substitution is performed.
+ * A null result means the command has an unterminated quote and must be rejected.
+ */
+export function tokenizeValidationCommand(command) {
+    const value = String(command ?? '');
+    const tokens = [];
+    let current = '';
+    let tokenStarted = false;
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index < value.length; index += 1) {
+        const ch = value[index];
+        if (escaped) {
+            current += ch;
+            tokenStarted = true;
+            escaped = false;
+            continue;
+        }
+        if (ch === '\\' && quote !== "'") {
+            const next = value[index + 1];
+            if (next !== undefined && (/\s/.test(next) || next === '"' || next === "'" || next === '\\')) {
+                escaped = true;
+                tokenStarted = true;
+                continue;
+            }
+        }
+        if (quote !== null) {
+            if (ch === quote) {
+                quote = null;
+            }
+            else {
+                current += ch;
+            }
+            tokenStarted = true;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            tokenStarted = true;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            if (tokenStarted) {
+                tokens.push(current);
+                current = '';
+                tokenStarted = false;
+            }
+            continue;
+        }
+        current += ch;
+        tokenStarted = true;
+    }
+    if (quote !== null)
+        return null;
+    if (escaped) {
+        current += '\\';
+        tokenStarted = true;
+    }
+    if (tokenStarted)
+        tokens.push(current);
+    return tokens;
+}
 // Node flags that turn `node` into an arbitrary-code evaluator or preload hook. A legit validation command is
 // `node <script> [args]`; these flags must be denied by the sandbox and must never be hidden by missing-script skip.
 export const BLOCKED_NODE_FLAGS = new Set([
@@ -12,6 +76,10 @@ export const BLOCKED_NODE_FLAGS = new Set([
     '--inspect', '--inspect-brk', '--inspect-port', '--inspect-publish-uid',
     // Watch: keeps the process alive past its work → hangs validation until the sandbox SIGKILLs it (DoS).
     '--watch', '--watch-path', '--watch-preserve-output',
+    // Package/test runners execute code selected from package metadata or the checkout, not one declared script.
+    '--run', '--test',
+    // Input-type changes stdin into an evaluator; validation must always name a script explicitly.
+    '--input-type', '-',
     // Module-resolution override: can redirect imports/requires to attacker-chosen code paths.
     '--conditions', '-C',
 ]);
@@ -28,32 +96,72 @@ export function nodeFlagViolation(executable, args) {
     if (!isNodeExecutable(executable))
         return null;
     for (const a of args) {
+        // Node stops interpreting its own flags at the first script (or `--` delimiter). Anything after that is
+        // an argv value owned by the script, even when it happens to match a blocked Node option name.
+        if (a === '--' || !a.startsWith('-'))
+            return null;
         const flag = a.split('=')[0] ?? a;
         if (BLOCKED_NODE_FLAGS.has(flag))
             return flag;
     }
     return null;
 }
+const SAFE_NODE_SCRIPT_FLAGS = new Set(['-c', '--check']);
+const SAFE_NODE_NO_SCRIPT_FLAGS = new Set(['-v', '--version', '-h', '--help']);
+/**
+ * 将 Node 命令限制为明确的脚本位置，防止带参数的选项吞掉下一个 token 后绕过脚本路径检查。
+ * 验证只需要普通脚本、语法检查，以及兼容旧 Gene 的 version/help 身份检查；其他前置选项默认拒绝。
+ */
+export function classifyNodeValidationInvocation(executable, args) {
+    if (!isNodeExecutable(executable))
+        return { kind: 'invalid' };
+    const blocked = nodeFlagViolation(executable, args);
+    if (blocked)
+        return { kind: 'invalid', option: blocked };
+    if (args.length === 1 && SAFE_NODE_NO_SCRIPT_FLAGS.has(args[0])) {
+        return { kind: 'safe_no_script' };
+    }
+    let index = 0;
+    let afterEndOfOptions = false;
+    while (index < args.length) {
+        const token = args[index];
+        if (token === '--') {
+            afterEndOfOptions = true;
+            index += 1;
+            break;
+        }
+        if (SAFE_NODE_SCRIPT_FLAGS.has(token)) {
+            index += 1;
+            continue;
+        }
+        if (token.startsWith('-')) {
+            return { kind: 'invalid', option: token.split('=')[0] ?? token };
+        }
+        break;
+    }
+    const script = args[index];
+    if (!script || (!afterEndOfOptions && script.startsWith('-')))
+        return { kind: 'invalid' };
+    return { kind: 'script', script };
+}
 /** 命令首 token(可执行名)是否在项目声明的 allowlist 内. */
 export function isAllowed(cmd, allowlist) {
-    const head = cmd.trim().split(/\s+/)[0] ?? '';
+    const tokens = tokenizeValidationCommand(cmd);
+    const head = tokens?.[0] ?? '';
     return allowlist.includes(head);
 }
-/** Extract the local script targeted by `node <script> ...`, or null for non-script node commands. */
+/** Extract the unambiguous script targeted by `node <script> ...`, or null for non-script/unsupported commands. */
 export function validationScriptPath(cmd) {
-    const tokens = String(cmd ?? '').trim().split(/\s+/);
+    const tokens = tokenizeValidationCommand(cmd);
+    if (!tokens || tokens.length < 2)
+        return null;
     const executable = tokens[0] ?? '';
-    if (tokens.length < 2 || !isNodeExecutable(executable))
+    if (!isNodeExecutable(executable))
         return null;
-    if (SHELL_METACHARS.test(cmd) || nodeFlagViolation(executable, tokens.slice(1)))
+    if (SHELL_METACHARS.test(cmd))
         return null;
-    for (let i = 1; i < tokens.length; i += 1) {
-        const token = tokens[i];
-        if (token.startsWith('-'))
-            continue;
-        return /\.(?:c|m)?js$/.test(token) ? token : null;
-    }
-    return null;
+    const invocation = classifyNodeValidationInvocation(executable, tokens.slice(1));
+    return invocation.kind === 'script' ? invocation.script : null;
 }
 /** stdout 摘要 = 首行 + 末行(去 canary.js 隐形约定: 不找魔法字符串, 只留可读摘要). */
 export function summarizeStdout(stdout) {
@@ -68,18 +176,58 @@ export function summarizeStdout(stdout) {
  * 跑校验(M4A-4). 判价值 = **exit code + stdout 摘要**, 不依赖 canary.js 魔法字符串(批注#22).
  * 不在 allowlist 的命令 auto-deny(不执行, allowed=false), 守无人值守安全.
  */
-export async function runValidation(plan, run) {
+export async function runValidation(plan, run, signal) {
     const results = [];
+    let cancelled = signal?.aborted === true;
     for (const c of plan.commands) {
+        if (signal?.aborted) {
+            cancelled = true;
+            break;
+        }
         const label = c.label ?? c.cmd;
         if (!isAllowed(c.cmd, plan.allowlist)) {
             results.push({ label, cmd: c.cmd, allowed: false, exitCode: null, stdoutSummary: '', passed: false });
             continue;
         }
-        const out = await run(c.cmd);
+        const out = await run(c.cmd, signal);
         results.push({ label, cmd: c.cmd, allowed: true, exitCode: out.exitCode, stdoutSummary: summarizeStdout(out.stdout), passed: out.exitCode === 0 });
+        // runner 可能在返回结果后才观察到取消；此时不能让完整的 exit-0 列表伪装成通过。
+        if (signal?.aborted) {
+            cancelled = true;
+            break;
+        }
     }
     // 全部 allowed 的命令都 exit 0 才算通过; 有命令被 deny 视为未通过(校验不完整)
-    const passed = results.length > 0 && results.every((r) => r.allowed && r.passed);
-    return { results, passed };
+    const passed = !cancelled && results.length > 0 && results.every((r) => r.allowed && r.passed);
+    return { results, passed, cancelled };
+}
+/**
+ * 检查验证命令是否安全可作为 Gene.validation 条目使用（忠实移植 v1 policyCheck.isValidationCommandAllowed）。
+ * Gene 验证命令只允许 `node …` 形式，不允许非 node 命令（如 pnpm/npm/echo 等）。
+ * 安全条件：
+ * 1. 必须以 `node ` 开头
+ * 2. 不包含命令替换（` 或 $(）
+ * 3. 不包含 shell 元字符（引号外）
+ * 4. 不包含被阻止的 node 标志（-e/--eval/--print 等）
+ */
+export function isValidationCommandAllowed(cmd) {
+    const c = String(cmd || '').trim();
+    if (!c)
+        return false;
+    // 不允许命令替换
+    if (/`|\$\(/.test(c))
+        return false;
+    // 移除引号内的内容后检查 shell 元字符
+    const stripped = c.replace(/"[^"]*"/g, '').replace(/'[^']*'/g, '');
+    if (SHELL_METACHARS.test(stripped))
+        return false;
+    // 检查被阻止或会让脚本位置产生歧义的 node 标志
+    const tokens = tokenizeValidationCommand(c);
+    if (!tokens)
+        return false;
+    const executable = tokens[0] ?? '';
+    if (executable !== 'node')
+        return false;
+    const args = tokens.slice(1);
+    return classifyNodeValidationInvocation(executable, args).kind !== 'invalid';
 }