@evomap/evolver-core 2.0.0-beta.9 → 2.0.0

package/dist/verify/sandboxRunner.js

@@ -5,41 +5,205 @@
 // module hardens EXECUTION: blocked node eval-flags, shell-metachar rejection, a fresh wiped temp cwd,
 // a scrubbed env (no secrets leak in), and a SIGKILL timeout. Output is folded + truncated.
 import { spawn, spawnSync } from 'node:child_process';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, rmdirSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { isNodeExecutable, nodeFlagViolation, SHELL_METACHARS } from './validation.js';
 const DEFAULT_TIMEOUT_MS = 60_000;
 const MAX_TIMEOUT_MS = 120_000;
 const MAX_OUTPUT_CHARS = 4000;
+const CGROUP_ROOT = '/sys/fs/cgroup';
+const TRUSTED_SYSTEM_PATH = '/usr/sbin:/usr/bin:/sbin:/bin';
+const SYSTEM_SH = '/bin/sh';
+const SYSTEM_UNSHARE = ['/usr/bin/unshare', '/bin/unshare'].find((path) => existsSync(path)) ?? '/usr/bin/unshare';
+const RESOURCE_LIMITS = {
+    memoryBytes: 1024 * 1024 * 1024,
+    processes: 64,
+    cpuQuota: '100000 100000',
+    scratchBytes: 256 * 1024 * 1024,
+};
 // Env scrub: only these keys reach the child, so node-secrets/tokens in the parent env cannot leak into validation.
 const DEFAULT_ENV_ALLOW = ['PATH', 'HOME', 'LANG', 'LC_ALL', 'TMPDIR', 'SYSTEMROOT'];
 /** Credential dirs hidden under $HOME when hideHomeSecrets is set (dirs only — never where binaries live). */
 const SECRET_HOME_DIRS = ['.evomap', '.ssh', '.aws', '.gnupg', '.docker', '.kube'];
 // Fixed setup run inside the mount ns: tmpfs over each existing secret dir, then exec the command. The command
 // is passed as POSITIONAL args (`exec "$@"`), never interpolated into the script — no shell-injection vector.
-const HIDE_SECRETS_SCRIPT = `for d in ${SECRET_HOME_DIRS.map((d) => `"$HOME/${d}"`).join(' ')}; do [ -d "$d" ] && mount -t tmpfs none "$d" 2>/dev/null; done; exec "$@"`;
+const HIDE_SECRETS_SETUP = `PATH=${TRUSTED_SYSTEM_PATH}; export PATH; for d in ${SECRET_HOME_DIRS.map((d) => `"$HOME/${d}"`).join(' ')}; do if [ -d "$d" ]; then mount -t tmpfs none "$d" 2>/dev/null || exit 126; fi; done`;
+const READ_ONLY_FILESYSTEM_SETUP = [
+    `PATH=${TRUSTED_SYSTEM_PATH}; export PATH`,
+    'session_tmp="$1"; shift',
+    'validation_root="$1"; shift',
+    'validation_cwd="$1"; shift',
+    'host_bin="$1"; shift',
+    '[ -n "$HOME" ] && [ "$HOME" != / ] && [ -d "$HOME" ] || exit 126',
+    'case "$validation_cwd/" in "$validation_root/"*) ;; *) exit 126 ;; esac',
+    'case "$HOME/" in "$validation_root/"*) exit 126 ;; esac',
+    `mount -t tmpfs -o size=${RESOURCE_LIMITS.scratchBytes},nr_inodes=65536 none "$session_tmp" 2>/dev/null || exit 126`,
+    'mkdir -p "$session_tmp/source" "$session_tmp/home" || exit 126',
+    'mkdir -p "$session_tmp/dev" || exit 126',
+    ': > "$session_tmp/node" || exit 126',
+    'mount --bind "$validation_root" "$session_tmp/source" 2>/dev/null || exit 126',
+    'mount --bind "$host_bin" "$session_tmp/node" 2>/dev/null || exit 126',
+    'for device in null zero random urandom; do : > "$session_tmp/dev/$device" || exit 126; mount --bind "/dev/$device" "$session_tmp/dev/$device" 2>/dev/null || exit 126; done',
+    'mount -t tmpfs none "$HOME" 2>/dev/null || exit 126',
+    '[ ! -d /run ] || mount -t tmpfs none /run 2>/dev/null || exit 126',
+    'mount -t tmpfs none /tmp 2>/dev/null || exit 126',
+    'mkdir -p "$validation_root" || exit 126',
+    'mount --bind "$session_tmp/source" "$validation_root" 2>/dev/null || exit 126',
+    'mounts="$(findmnt -rn -o TARGET -R /)" || exit 126',
+    '[ -n "$mounts" ] || exit 126',
+    'printf "%s\\n" "$mounts" | while IFS= read -r target; do mount -o remount,bind,ro "$target" 2>/dev/null || exit 126; done || exit 126',
+    'mount -o remount,bind,rw,exec "$session_tmp" 2>/dev/null || exit 126',
+    'mount -t tmpfs -o mode=755,size=65536,nr_inodes=64 none /dev 2>/dev/null || exit 126',
+    'for device in null zero random urandom; do : > "/dev/$device" || exit 126; mount --bind "$session_tmp/dev/$device" "/dev/$device" 2>/dev/null || exit 126; done',
+    'mount -o remount,ro /dev 2>/dev/null || exit 126',
+    'mount --rbind "$session_tmp" /tmp 2>/dev/null || exit 126',
+    'cd "$validation_cwd" || exit 126',
+    'export HOME=/tmp/home TMPDIR=/tmp TMP=/tmp TEMP=/tmp',
+].join('; ');
+const DROP_NAMESPACE_PRIVILEGES = [
+    'supervisor_pid=$$',
+    'exec 3<&0',
+    'setpriv --no-new-privs --securebits=+noroot,+noroot_locked --bounding-set=-all --inh-caps=-all --ambient-caps=-all -- /tmp/node "$@" </dev/null 3<&- & workload_pid=$!',
+    // The pipe is owned by the parent Node process. Kernel EOF is therefore a reliable parent-death signal,
+    // including SIGKILL, while unshare --kill-child propagates supervisor death through the PID namespace.
+    '(IFS= read -r _ <&3 || kill -KILL "$supervisor_pid") & watchdog_pid=$!',
+    'exec 3<&-',
+    'wait "$workload_pid"; status=$?',
+    'kill "$watchdog_pid" 2>/dev/null || true',
+    'wait "$watchdog_pid" 2>/dev/null || true',
+    'exit "$status"',
+].join('; ');
+function pathIsWithin(root, target) {
+    const rel = relative(root, target);
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+function currentCgroupPath() {
+    const entry = readFileSync('/proc/self/cgroup', 'utf8')
+        .split(/\r?\n/)
+        .find((line) => line.startsWith('0::'));
+    if (!entry)
+        return null;
+    const relativePath = entry.slice(3).replace(/^\/+/, '');
+    const path = resolve(CGROUP_ROOT, relativePath);
+    return pathIsWithin(CGROUP_ROOT, path) ? path : null;
+}
+/** Configure an already-created cgroup. Kept separate so limit values are testable without resource exhaustion. */
+export function configureSandboxResourceGroup(path) {
+    try {
+        const required = ['cgroup.procs', 'cgroup.kill', 'memory.max', 'memory.swap.max', 'memory.oom.group', 'pids.max', 'cpu.max'];
+        if (!required.every((name) => existsSync(join(path, name))))
+            return false;
+        writeFileSync(join(path, 'memory.max'), String(RESOURCE_LIMITS.memoryBytes));
+        writeFileSync(join(path, 'memory.swap.max'), '0');
+        writeFileSync(join(path, 'memory.oom.group'), '1');
+        writeFileSync(join(path, 'pids.max'), String(RESOURCE_LIMITS.processes));
+        writeFileSync(join(path, 'cpu.max'), RESOURCE_LIMITS.cpuQuota);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Allocate a delegated cgroup v2 for one validation command. Returns null unless every limit is enforceable. */
+export function createSandboxResourceGroup() {
+    if (process.platform !== 'linux' || !existsSync(join(CGROUP_ROOT, 'cgroup.controllers')))
+        return null;
+    let path = null;
+    try {
+        const parent = currentCgroupPath();
+        if (!parent)
+            return null;
+        path = join(parent, `evolver-validation-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`);
+        mkdirSync(path, { mode: 0o700 });
+        if (!configureSandboxResourceGroup(path))
+            throw new Error('required cgroup v2 controllers are not delegated');
+        let cleaned = false;
+        return {
+            procsFile: join(path, 'cgroup.procs'),
+            cleanup: () => {
+                if (cleaned)
+                    return;
+                cleaned = true;
+                try {
+                    writeFileSync(join(path, 'cgroup.kill'), '1');
+                }
+                catch { /* already empty or removed */ }
+                try {
+                    rmdirSync(path);
+                }
+                catch { /* kernel may release the empty group asynchronously */ }
+            },
+        };
+    }
+    catch {
+        if (path) {
+            try {
+                writeFileSync(join(path, 'cgroup.kill'), '1');
+            }
+            catch { /* best effort */ }
+            try {
+                rmdirSync(path);
+            }
+            catch { /* best effort */ }
+        }
+        return null;
+    }
+}
+/** Join the cgroup before exec, so attacker-controlled code never runs outside the aggregate resource budget. */
+export function resourceLimitedCommand(cmd, args, procsFile) {
+    const setup = 'printf "%s" "$$" > "$1" || exit 126; shift; exec "$@"';
+    return { cmd: SYSTEM_SH, args: ['-c', setup, 'sh', procsFile, cmd, ...args] };
+}
+export function sandboxResourceLimitsAvailable() {
+    const group = createSandboxResourceGroup();
+    if (!group)
+        return false;
+    group.cleanup();
+    return true;
+}
 /** Wrap an (executable,args) in unprivileged namespaces per the requested isolation (pure — testable). */
 export function isolationCommand(bin, args, opts) {
+    if (opts.readOnlyFilesystem && !opts.writableTmpDir) {
+        throw new Error('read-only filesystem isolation requires writableTmpDir');
+    }
+    if (opts.readOnlyFilesystem && (!opts.readOnlyRoot || !opts.cwd)) {
+        throw new Error('read-only filesystem isolation requires readOnlyRoot and cwd');
+    }
     const flags = ['-r'];
-    if (opts.hideHomeSecrets)
+    if (opts.hideHomeSecrets || opts.readOnlyFilesystem)
         flags.push('-m');
     if (opts.noNetwork)
         flags.push('-n');
-    if (!opts.noNetwork && !opts.hideHomeSecrets)
+    if (opts.readOnlyFilesystem)
+        flags.push('-p', '-i', '-u');
+    if (!opts.noNetwork && !opts.hideHomeSecrets && !opts.readOnlyFilesystem)
         return { cmd: bin, args: [...args] };
-    const base = [...flags, '--fork', '--kill-child', '--'];
+    const base = [...flags, '--fork', '--kill-child', ...(opts.readOnlyFilesystem ? ['--mount-proc'] : []), '--'];
+    const setup = [
+        ...(opts.hideHomeSecrets && !opts.readOnlyFilesystem ? [HIDE_SECRETS_SETUP] : []),
+        ...(opts.readOnlyFilesystem ? [READ_ONLY_FILESYSTEM_SETUP] : []),
+        opts.readOnlyFilesystem ? DROP_NAMESPACE_PRIVILEGES : 'exec "$@"',
+    ].join('; ');
     // Mount setup needs a launcher (sh runs the FIXED script then exec "$@"); net-only needs no shell.
-    return opts.hideHomeSecrets
-        ? { cmd: 'unshare', args: [...base, 'sh', '-c', HIDE_SECRETS_SCRIPT, 'sh', bin, ...args] }
-        : { cmd: 'unshare', args: [...base, bin, ...args] };
+    return opts.hideHomeSecrets || opts.readOnlyFilesystem
+        ? {
+            cmd: SYSTEM_UNSHARE,
+            args: [...base, SYSTEM_SH, '-c', setup, 'sh', ...(opts.readOnlyFilesystem
+                    ? [opts.writableTmpDir, opts.readOnlyRoot, opts.cwd]
+                    : []), bin, ...args],
+        }
+        : { cmd: SYSTEM_UNSHARE, args: [...base, bin, ...args] };
 }
 let unshareCache;
 /** Whether unprivileged user+mount+net namespaces (`unshare -r -m -n`) work here (cached) — covers both isolation modes. */
 export function unshareNetAvailable() {
     if (unshareCache === undefined) {
         try {
-            unshareCache = spawnSync('unshare', ['-r', '-m', '-n', 'true'], { timeout: 5000 }).status === 0;
+            unshareCache = spawnSync(SYSTEM_UNSHARE, ['-r', '-m', '-n', 'true'], {
+                env: { PATH: TRUSTED_SYSTEM_PATH },
+                timeout: 5000,
+            }).status === 0;
         }
         catch {
             unshareCache = false;
@@ -78,28 +242,63 @@ export function makeSandboxRunner(opts = {}) {
         if (badFlag)
             return deny(`rejected: blocked node flag ${badFlag}`);
         // Isolation (#26): fail-safe — if we can't actually create the namespaces, refuse rather than run un-isolated.
-        if ((opts.noNetwork || opts.hideHomeSecrets) && !(opts.unshareCheck ?? unshareNetAvailable)()) {
-            return deny('rejected: isolation (noNetwork/hideHomeSecrets) requested but unprivileged namespaces (unshare -r -m -n) are unavailable here');
+        if ((opts.noNetwork || opts.hideHomeSecrets || opts.readOnlyFilesystem) && !(opts.unshareCheck ?? unshareNetAvailable)()) {
+            return deny('rejected: requested namespace isolation is unavailable');
         }
+        const resourceGroup = opts.resourceLimits
+            ? (opts.resourceGroupFactory ?? createSandboxResourceGroup)()
+            : null;
+        if (opts.resourceLimits && !resourceGroup)
+            return deny('rejected: cgroup v2 resource limits are unavailable');
         const ownTemp = !opts.cwd;
         let cwd;
         try {
             cwd = opts.cwd ?? mkdtempSync(join(tmpdir(), 'evo-sbx-'));
         }
         catch (e) {
+            resourceGroup?.cleanup();
             return deny(`temp dir failed: ${e instanceof Error ? e.message : 'err'}`, 1);
         }
-        const cleanup = () => { if (ownTemp) {
-            try {
-                rmSync(cwd, { recursive: true, force: true });
+        let cleaned = false;
+        const cleanup = () => {
+            if (cleaned)
+                return;
+            cleaned = true;
+            resourceGroup?.cleanup();
+            if (ownTemp) {
+                try {
+                    rmSync(cwd, { recursive: true, force: true });
+                }
+                catch { /* best effort */ }
             }
-            catch { /* best effort */ }
-        } };
+        };
         // Resolve 'node' to the running binary so spawn(shell:false) works on Windows too (where bare 'node' would ENOENT).
         const bin = isNodeExecutable(executable) ? process.execPath : executable;
         try {
-            const { cmd: spawnCmd, args: spawnArgs } = isolationCommand(bin, args, { noNetwork: opts.noNetwork, hideHomeSecrets: opts.hideHomeSecrets });
-            const child = spawn(spawnCmd, spawnArgs, { shell: false, cwd, env: scrubEnv(envAllow), timeout, killSignal: 'SIGKILL', stdio: ['ignore', 'pipe', 'pipe'] });
+            const { cmd: spawnCmd, args: spawnArgs } = isolationCommand(bin, args, {
+                noNetwork: opts.noNetwork,
+                hideHomeSecrets: opts.hideHomeSecrets,
+                readOnlyFilesystem: opts.readOnlyFilesystem,
+                writableTmpDir: opts.writableTmpDir,
+                readOnlyRoot: opts.readOnlyRoot ?? cwd,
+                cwd,
+            });
+            const env = scrubEnv(envAllow);
+            if (opts.noNetwork || opts.hideHomeSecrets || opts.readOnlyFilesystem || opts.resourceLimits) {
+                env['PATH'] = TRUSTED_SYSTEM_PATH;
+            }
+            if (opts.readOnlyFilesystem) {
+                Object.assign(env, { TMPDIR: '/tmp', TMP: '/tmp', TEMP: '/tmp' });
+            }
+            const limited = resourceGroup ? resourceLimitedCommand(spawnCmd, spawnArgs, resourceGroup.procsFile) : { cmd: spawnCmd, args: spawnArgs };
+            const child = spawn(limited.cmd, limited.args, {
+                shell: false,
+                cwd,
+                env,
+                timeout,
+                killSignal: 'SIGKILL',
+                stdio: [opts.readOnlyFilesystem ? 'pipe' : 'ignore', 'pipe', 'pipe'],
+            });
             let out = '';
             const cap = (d) => { if (out.length < MAX_OUTPUT_CHARS)
                 out += String(d); };

package/dist/verify/sandboxedValidation.d.ts

@@ -1,3 +1,4 @@
+import { type SandboxResourceGroup } from './sandboxRunner.js';
 import { type ValidationResult } from './validation.js';
 export interface SandboxedValidationSkippedCommand {
     cmd: string;
@@ -19,11 +20,19 @@ export interface SandboxedValidationResult {
      */
     isolated: boolean;
 }
+export declare function readOnlyFilesystemIsolationAvailable(): boolean;
+export declare function readOnlyIsolationAvailable(): boolean;
 export interface SandboxedValidationOptions {
     /** Per-command timeout (ms), forwarded to the sandbox runner. */
     timeoutMs?: number;
     /** Test seam: override the unprivileged-namespace availability probe. */
     unshareCheck?: () => boolean;
+    /** Refuse before spawning when network/home namespace isolation is unavailable. */
+    requireIsolation?: boolean;
+    /** Checkout root to preserve read-only at its original absolute path. */
+    readOnlyRoot?: string;
+    /** Injected cgroup allocator (test seam). */
+    resourceGroupFactory?: () => SandboxResourceGroup | null;
 }
 /**
  * Run validation commands in the hardened sandbox. Isolation (no-network + hidden home secrets) is requested only

package/dist/verify/sandboxedValidation.js

@@ -3,10 +3,72 @@
 // metachar rejection, node-eval-flag blocking, a scrubbed env, a SIGKILL timeout, and — where unprivileged
 // namespaces exist — no network + hidden home secrets, so a validation command cannot phone home / exfiltrate to
 // game the pass/fail. This is the "verifier outside the repo, untrusted caller" half the safety model relies on.
-import { existsSync } from 'node:fs';
-import { isAbsolute, resolve } from 'node:path';
-import { makeSandboxRunner, unshareNetAvailable } from './sandboxRunner.js';
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, realpathSync, rmSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { isolationCommand, makeSandboxRunner, sandboxResourceLimitsAvailable, unshareNetAvailable, } from './sandboxRunner.js';
 import { runValidation, validationScriptPath } from './validation.js';
+let readOnlyIsolationAvailableCache;
+let readOnlyFilesystemIsolationAvailableCache;
+export function readOnlyFilesystemIsolationAvailable() {
+    if (process.platform !== 'linux')
+        return false;
+    if (readOnlyFilesystemIsolationAvailableCache !== undefined)
+        return readOnlyFilesystemIsolationAvailableCache;
+    const probeRoot = mkdtempSync('/var/tmp/evolver-isolation-probe-');
+    const probeHome = mkdtempSync('/var/tmp/evolver-isolation-home-');
+    const scratch = join(probeRoot, 'session');
+    const probeCwd = join(probeRoot, 'cwd');
+    try {
+        mkdirSync(scratch);
+        mkdirSync(probeCwd);
+        const probe = isolationCommand(process.execPath, ['--version'], {
+            noNetwork: true,
+            hideHomeSecrets: true,
+            readOnlyFilesystem: true,
+            writableTmpDir: scratch,
+            readOnlyRoot: probeCwd,
+            cwd: probeCwd,
+        });
+        readOnlyFilesystemIsolationAvailableCache = spawnSync(probe.cmd, probe.args, {
+            cwd: probeCwd,
+            env: {
+                HOME: process.env.HOME ?? probeHome,
+                PATH: process.env.PATH ?? '/usr/bin:/bin',
+            },
+            input: '\n',
+            timeout: 5_000,
+            stdio: ['pipe', 'ignore', 'ignore'],
+        }).status === 0;
+    }
+    catch {
+        readOnlyFilesystemIsolationAvailableCache = false;
+    }
+    finally {
+        rmSync(probeRoot, { recursive: true, force: true });
+        rmSync(probeHome, { recursive: true, force: true });
+    }
+    return readOnlyFilesystemIsolationAvailableCache;
+}
+export function readOnlyIsolationAvailable() {
+    if (process.platform !== 'linux')
+        return false;
+    if (readOnlyIsolationAvailableCache !== undefined)
+        return readOnlyIsolationAvailableCache;
+    readOnlyIsolationAvailableCache = sandboxResourceLimitsAvailable() && readOnlyFilesystemIsolationAvailable();
+    return readOnlyIsolationAvailableCache;
+}
+function validationReadOnlyRoot(cwd) {
+    let current = resolve(cwd);
+    while (true) {
+        if (existsSync(join(current, '.git')))
+            return current;
+        const parent = dirname(current);
+        if (parent === current)
+            return resolve(cwd);
+        current = parent;
+    }
+}
 /**
  * Run validation commands in the hardened sandbox. Isolation (no-network + hidden home secrets) is requested only
  * when unprivileged namespaces are available; elsewhere (Windows/macOS) it degrades to the non-namespace hardening
@@ -15,26 +77,37 @@ import { runValidation, validationScriptPath } from './validation.js';
  * preserving prior behavior; note this differs from runValidation's own "no commands = not verified" stance.
  */
 export async function runSandboxedValidation(cmds, cwd, opts = {}) {
-    const isolated = (opts.unshareCheck ?? unshareNetAvailable)();
+    const isolationCheck = opts.unshareCheck ?? (opts.requireIsolation ? readOnlyIsolationAvailable : unshareNetAvailable);
+    const isolated = isolationCheck();
+    if (opts.requireIsolation && !isolated) {
+        return { passed: false, score: 0.2, results: [], skipped: [], isolated: false };
+    }
+    let validationCwd = resolve(cwd);
+    let readOnlyRoot = opts.readOnlyRoot ? resolve(opts.readOnlyRoot) : validationReadOnlyRoot(validationCwd);
+    if (opts.requireIsolation && isolated) {
+        try {
+            validationCwd = realpathSync(validationCwd);
+            readOnlyRoot = realpathSync(readOnlyRoot);
+        }
+        catch {
+            return { passed: false, score: 0.2, results: [], skipped: [], isolated };
+        }
+        if (dirname(readOnlyRoot) === readOnlyRoot || !pathIsWithin(readOnlyRoot, validationCwd)) {
+            return { passed: false, score: 0.2, results: [], skipped: [], isolated };
+        }
+    }
     // ONLY a truly empty command set is a vacuous pass (nothing to verify). A non-empty set with blank entries is a
     // malformed plan, NOT a pass: blanks are kept (trimmed to '') so they fall outside the allowlist and fail, rather
     // than being silently dropped into a pass (Bugbot).
     if (cmds.length === 0)
         return { passed: true, score: 0.95, results: [], skipped: [], isolated };
-    const runner = makeSandboxRunner({
-        cwd,
-        noNetwork: isolated,
-        hideHomeSecrets: isolated,
-        ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),
-        ...(opts.unshareCheck ? { unshareCheck: opts.unshareCheck } : {}),
-    });
     const list = cmds.map((c) => String(c ?? '').trim());
     // Validation plans may reference repo-relative scripts that do not exist in this checkout; skip only those.
     const skipped = [];
     const runnable = [];
     for (const cmd of list) {
         const script = validationScriptPath(cmd);
-        if (script && !isAbsolute(script) && !existsSync(resolve(cwd, script))) {
+        if (script && !isAbsolute(script) && !existsSync(resolve(validationCwd, script))) {
             skipped.push({ cmd, script, reason: 'missing_script' });
             console.warn(`[Validation] Skipping validation command (script not in repoRoot): ${script}`);
             continue;
@@ -43,8 +116,31 @@ export async function runSandboxedValidation(cmds, cwd, opts = {}) {
     }
     if (runnable.length === 0)
         return { passed: false, score: 0.2, results: [], skipped, isolated };
+    const scratch = isolated && opts.requireIsolation
+        ? mkdtempSync('/var/tmp/evolver-validation-')
+        : undefined;
+    const runner = makeSandboxRunner({
+        cwd: validationCwd,
+        noNetwork: isolated,
+        hideHomeSecrets: isolated,
+        readOnlyFilesystem: isolated && opts.requireIsolation,
+        resourceLimits: isolated && opts.requireIsolation,
+        writableTmpDir: scratch,
+        readOnlyRoot,
+        ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),
+        ...(opts.resourceGroupFactory ? { resourceGroupFactory: opts.resourceGroupFactory } : {}),
+        unshareCheck: () => isolated,
+    });
     const allowlist = [...new Set(runnable.map((c) => c.split(/\s+/)[0] ?? '').filter(Boolean))];
-    const { results, passed } = await runValidation({ commands: runnable.map((cmd) => ({ cmd })), allowlist }, runner);
+    let results;
+    let passed;
+    try {
+        ({ results, passed } = await runValidation({ commands: runnable.map((cmd) => ({ cmd })), allowlist }, runner));
+    }
+    finally {
+        if (scratch)
+            rmSync(scratch, { recursive: true, force: true });
+    }
     const complete = skipped.length === 0;
     return {
         passed: passed && complete,
@@ -53,4 +149,8 @@ export async function runSandboxedValidation(cmds, cwd, opts = {}) {
         skipped,
         isolated,
     };
+}
+function pathIsWithin(root, target) {
+    const rel = relative(root, target);
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
 }

package/dist/verify/validation.d.ts

@@ -38,4 +38,14 @@ export declare function summarizeStdout(stdout: string): string;
 export declare function runValidation(plan: ValidationPlan, run: CommandRunner): Promise<{
     results: ValidationResult[];
     passed: boolean;
-}>;
+}>;
+/**
+ * 检查验证命令是否安全可作为 Gene.validation 条目使用（忠实移植 v1 policyCheck.isValidationCommandAllowed）。
+ * Gene 验证命令只允许 `node …` 形式，不允许非 node 命令（如 pnpm/npm/echo 等）。
+ * 安全条件：
+ * 1. 必须以 `node ` 开头
+ * 2. 不包含命令替换（` 或 $(）
+ * 3. 不包含 shell 元字符（引号外）
+ * 4. 不包含被阻止的 node 标志（-e/--eval/--print 等）
+ */
+export declare function isValidationCommandAllowed(cmd: string): boolean;

package/dist/verify/validation.js

@@ -82,4 +82,35 @@ export async function runValidation(plan, run) {
     // 全部 allowed 的命令都 exit 0 才算通过; 有命令被 deny 视为未通过(校验不完整)
     const passed = results.length > 0 && results.every((r) => r.allowed && r.passed);
     return { results, passed };
+}
+/**
+ * 检查验证命令是否安全可作为 Gene.validation 条目使用（忠实移植 v1 policyCheck.isValidationCommandAllowed）。
+ * Gene 验证命令只允许 `node …` 形式，不允许非 node 命令（如 pnpm/npm/echo 等）。
+ * 安全条件：
+ * 1. 必须以 `node ` 开头
+ * 2. 不包含命令替换（` 或 $(）
+ * 3. 不包含 shell 元字符（引号外）
+ * 4. 不包含被阻止的 node 标志（-e/--eval/--print 等）
+ */
+export function isValidationCommandAllowed(cmd) {
+    const c = String(cmd || '').trim();
+    if (!c)
+        return false;
+    // 只允许 node 命令作为验证命令
+    if (!c.startsWith('node '))
+        return false;
+    // 不允许命令替换
+    if (/`|\$\(/.test(c))
+        return false;
+    // 移除引号内的内容后检查 shell 元字符
+    const stripped = c.replace(/"[^"]*"/g, '').replace(/'[^']*'/g, '');
+    if (SHELL_METACHARS.test(stripped))
+        return false;
+    // 检查被阻止的 node 标志
+    const tokens = c.split(/\s+/);
+    const executable = tokens[0] ?? '';
+    const args = tokens.slice(1);
+    if (nodeFlagViolation(executable, args))
+        return false;
+    return true;
 }

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@evomap/evolver-core",
-  "version": "2.0.0-beta.9",
+  "version": "2.0.0",
   "private": false,
   "type": "module",
+  "engines": {
+    "node": "^22.13.0 || >=23.4.0"
+  },
   "description": "hub-无关核心: 算法引擎/原材料/mailbox/资产库/workflow",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -23,7 +26,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "tag": "v2-beta"
+    "tag": "latest"
   },
   "files": [
     "dist/",