@goodandready/dsh-moa 0.2.44 → 0.2.46

package/lib/moa-runner.js

@@ -9,7 +9,7 @@ import { parseWinnerIndex, parseRecommendedAssembler } from './moa-parser.js'
 import { REFERENCE_SYSTEM_PROMPT, callWithTransientRetry, runReferencesParallel } from './moa-candidates.js'
 import { executeTestGateForCandidates } from './moa-test-gate.js'
 import { executeMultiJudgePanel, buildCompositeBlockDirectives } from './moa-multi-judge.js'
-import { applyBudgetGuardrails } from './moa-budget.js'
+import { applyBudgetGuardrails, checkPhaseBudget, estimateRound2Cost, estimateDownstreamCost, createBudgetAbortPayload } from './moa-budget.js'
 import { extractPriorTurnBaseline, pruneMultiTurnMessages } from './moa-context.js'
 import { generateMoABenchmarkReport } from './moa-report.js'
 // Re-exports for consumers & backward compatibility
@@ -27,13 +27,8 @@ export async function runMoAPipeline({
   messages = [],
   preset,
   callLlm,
-  cwd = process.cwd(),
-  prices = {},
-  onProgress = null,
-  historyFilePath = null,
-  liveCanvas = null,
-  onStreamDelta = null,
-  signal = null,
+  cwd = process.cwd(), prices = {}, onProgress = null,
+  historyFilePath = null, liveCanvas = null, onStreamDelta = null, signal = null,
   testGateEnabled = null, testCommand = null, execFn = null,
   webServerPort = null, timeMachineEngine = null, timeMachineUrl = null,
   force = isTestEnvironment() ? true : false, checkpoint = true, checkpointFn = null, runId: customRunId = null,
@@ -94,14 +89,7 @@ export async function runMoAPipeline({
     judgeModels: preset?.multi_judge_enabled ? preset?.judge_models : [],
   })
   if (!budgetCheck.allowed) {
-    return {      kind: 'failure', content: `🛑 Budget Guardrail Abort: ${budgetCheck.reason}`,
-      aggregator: slotLabel(primaryJudge), references: [], presetName: preset?.name || 'default',
-      isRefinement, isFastMode, winningIndex: 0, winnerModel: 'none', promotedFiles: [],
-      usage: { totalTokens: 0, totalCostUsd: 0, candidates: [], aggregator: { totalTokens: 0, costUsd: 0 } },
-      skippedFiles: collectedCtx?.skippedFiles || 0,
-      skippedList: collectedCtx?.skippedList || [],
-      durationMs: Date.now() - startTime,
-    }
+    return createBudgetAbortPayload({ reason: budgetCheck.reason, primaryJudge, referenceOutputs: [], currentSpentUsd: 0, preset, isRefinement, isFastMode, collectedCtx, startTime })
   }
   const effectiveReferences = budgetCheck.references
   if (budgetCheck.action === 'trim' && typeof onProgress === 'function') {
@@ -145,26 +133,14 @@ export async function runMoAPipeline({
   const successfulRefs = referenceOutputs.filter((r) => r.ok)
   if (successfulRefs.length === 0) {
     const reasons = referenceOutputs.map((r) => `${r.label}: ${r.error || 'unknown error'}`).join('; ')
+    const totalTokens = referenceOutputs.reduce((acc, r) => acc + (r.usage?.totalTokens || 0), 0)
+    const totalCostUsd = Number((referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0)).toFixed(5))
     return {
-      kind: 'failure',
-      content: `⚠️ All advisor models (${referenceOutputs.length}) failed: ${reasons}`,
-      aggregator: slotLabel(primaryJudge),
-      references: referenceOutputs,
-      presetName: preset?.name || 'default',
-      isRefinement,
-      isFastMode,
-      winningIndex: 0,
-      winnerModel: 'none',
-      promotedFiles: [],
-      usage: {
-        totalTokens: 0,
-        totalCostUsd: 0,
-        candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
-        aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 },
-      },
-      skippedFiles: collectedCtx?.skippedFiles || 0,
-      skippedList: collectedCtx?.skippedList || [],
-      durationMs: Date.now() - startTime,
+      kind: 'failure', content: `⚠️ All advisor models (${referenceOutputs.length}) failed: ${reasons}`,
+      aggregator: slotLabel(primaryJudge), references: referenceOutputs, presetName: preset?.name || 'default',
+      isRefinement, isFastMode, winningIndex: 0, winnerModel: 'none', promotedFiles: [],
+      usage: { totalTokens, totalCostUsd, candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })), aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 } },
+      skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [], durationMs: Date.now() - startTime,
     }
   }
   // 5. Extract file blocks & write candidate workspaces
@@ -240,25 +216,11 @@ export async function runMoAPipeline({
       logger.warn('[dsh-moa] Failed to record questionnaire run in history:', histErr?.message || histErr)
     }
     return {
-      kind: 'questions',
-      content: questionsContent,
-      aggregator: slotLabel(primaryJudge),
-      references: referenceOutputs,
-      presetName: preset?.name || 'default',
-      isRefinement,
-      isFastMode,
-      winningIndex: 0,
-      winnerModel: 'none',
-      promotedFiles: [],
-      usage: {
-        totalTokens,
-        totalCostUsd,
-        candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
-        aggregator: qUsage,
-      },
-      skippedFiles: collectedCtx?.skippedFiles || 0,
-      skippedList: collectedCtx?.skippedList || [],
-      durationMs,
+      kind: 'questions', content: questionsContent, aggregator: slotLabel(primaryJudge),
+      references: referenceOutputs, presetName: preset?.name || 'default', isRefinement, isFastMode,
+      winningIndex: 0, winnerModel: 'none', promotedFiles: [],
+      usage: { totalTokens, totalCostUsd, candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })), aggregator: qUsage },
+      skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [], durationMs,
     }
   }
 
@@ -282,15 +244,34 @@ export async function runMoAPipeline({
       if (signal?.aborted || promoteErr?.message?.includes('aborted') || promoteErr?.name === 'AbortError' || promoteErr?.message === 'Turn aborted') {
         return { error: new Error('Turn aborted') }
       }
-      return {        kind: 'failure', error: promoteErr,
+      const totalTokens = referenceOutputs.reduce((acc, r) => acc + (r.usage?.totalTokens || 0), 0)
+      const totalCostUsd = Number((referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0)).toFixed(5))
+      const durationMs = Date.now() - startTime
+      try {
+        await recordMoaRunAsync({
+          id: runId, cwd, prompt: userPrompt, preset: preset?.name || 'default',
+          isRefinement, isFastMode: true, candidates: candidatesForHistory(referenceOutputs),
+          aggregator: null, winnerIndex: 0, winnerModel: 'none',
+          promotedFiles: [], totalTokens, totalCostUsd, durationMs,
+          error: promoteErr?.message || String(promoteErr),
+        }, historyFilePath || undefined)
+      } catch (histErr) {
+        logger.warn('[dsh-moa] Failed to record fast synthesis failure in history:', histErr?.message || histErr)
+      }
+      return {
+        kind: 'failure', error: promoteErr,
         content: '🛑 Checkpoint or Promotion Failure: ' + (promoteErr?.message || String(promoteErr)),
         aggregator: 'Fast Mode (Direct)', references: referenceOutputs,
         presetName: preset?.name || 'default', isRefinement, isFastMode: true,
-        winningIndex: single.index, winnerModel: single.label, promotedFiles: [], runId,
-        usage: { totalTokens: 0, totalCostUsd: 0, candidates: [], aggregator: { totalTokens: 0, costUsd: 0 } },
+        winningIndex: 0, winnerModel: 'none', promotedFiles: [], runId,
+        usage: {
+          totalTokens, totalCostUsd,
+          candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
+          aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 },
+        },
         skippedFiles: collectedCtx?.skippedFiles || 0,
         skippedList: collectedCtx?.skippedList || [],
-        durationMs: Date.now() - startTime,
+        durationMs,
       }
     }
 
@@ -311,18 +292,11 @@ export async function runMoAPipeline({
     }
 
     return {
-      kind: 'synthesis', content: single.text, aggregator: 'Fast Mode (Direct)',
-      references: referenceOutputs, presetName: preset?.name || 'default',
-      isRefinement, isFastMode: true, winningIndex: single.index,
-      winnerModel: single.label, promotedFiles, runId,
-      ...(livePreview ? { liveCanvas: livePreview } : {}),
-      usage: {
-        totalTokens, totalCostUsd,
-        candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
-        aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 },
-      },
-      skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [],
-      durationMs,
+      kind: 'synthesis', content: single.text, aggregator: 'Fast Mode (Direct)', references: referenceOutputs,
+      presetName: preset?.name || 'default', isRefinement, isFastMode: true, winningIndex: single.index,
+      winnerModel: single.label, promotedFiles, runId, ...(livePreview ? { liveCanvas: livePreview } : {}),
+      usage: { totalTokens, totalCostUsd, candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })), aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 } },
+      skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [], durationMs,
     }
   }
 
@@ -332,7 +306,25 @@ export async function runMoAPipeline({
   }
 
   // 7b. Consilium Round 2 (Peer Critique) if enabled
-  if (isPeerCritiqueEnabled && successfulRefs.length > 1) {
+  let runRound2 = isPeerCritiqueEnabled && successfulRefs.length > 1
+  if (runRound2 && preset?.budget_guard_enabled && preset?.max_budget_usd > 0) {
+    const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0)
+    const r2Next = estimateRound2Cost(successfulRefs, prices, maxTokens)
+    const downNext = estimateDownstreamCost(primaryJudge, preset?.judge_models, successfulRefs.length, prices, maxTokens)
+    const phaseCheck = checkPhaseBudget({ phaseName: 'Consilium Round 2', currentSpentUsd: currentSpent, nextPhaseCostUsd: r2Next + downNext, maxBudgetUsd: preset.max_budget_usd, action: preset.budget_action || 'trim', enabled: true })
+    if (!phaseCheck.allowed) {
+      if (phaseCheck.action === 'abort') {
+        await cleanMoaWorkspaces(cwd, { runId })
+        return createBudgetAbortPayload({ reason: phaseCheck.reason, primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime })
+      }
+      runRound2 = false
+      if (typeof onProgress === 'function') {
+        onProgress(`✂️ *Skipping Round 2 to stay within budget ($${preset.max_budget_usd.toFixed(4)})*\n`)
+      }
+    }
+  }
+
+  if (runRound2) {
     if (typeof onProgress === 'function') {
       onProgress('🤝 *Consilium Round 2: Candidates reviewing peer proposals in parallel...*\n')
     }
@@ -371,8 +363,8 @@ export async function runMoAPipeline({
           const extraCost = estimateTokenCost(slot, res.usage, prices)
           cand.costUsd = Number(((cand.costUsd || 0) + extraCost.costUsd).toFixed(5))
         }
-      } catch (r2CostErr) {
-        logger.warn('[dsh-moa] Failed to estimate Round 2 cost:', r2CostErr?.message || r2CostErr)
+      } catch (r2Err) {
+        logger.warn(`[dsh-moa] Round 2 peer critique failed for candidate ${cand.index}:`, r2Err?.message || r2Err)
       }
     })
     await Promise.allSettled(r2Promises)
@@ -412,6 +404,15 @@ export async function runMoAPipeline({
     : null
 
   // 8. Synthesis phase via primary judge or fallback chain
+  if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0 && !isFastMode) {
+    const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + (multiJudgeResult?.totalCostUsd || 0)
+    const downNext = estimateDownstreamCost(primaryJudge, [], successfulRefs.length, prices, maxTokens)
+    const phaseCheck = checkPhaseBudget({ phaseName: 'Judge Synthesis', currentSpentUsd: currentSpent, nextPhaseCostUsd: downNext, maxBudgetUsd: preset.max_budget_usd, action: preset.budget_action || 'trim', enabled: true })
+    if (!phaseCheck.allowed && fallbackJudges.length === 0) {
+      await cleanMoaWorkspaces(cwd, { runId })
+      return createBudgetAbortPayload({ reason: phaseCheck.reason, primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime })
+    }
+  }
   const synthesisPrompt = buildSynthesisPrompt(userPrompt, referenceOutputs, judgeCriteria, {
     curatorSynthesis: isCuratorSynthesis,
     blindEvaluation: isBlindEvaluation,
@@ -429,6 +430,18 @@ export async function runMoAPipeline({
     const currentJudge = judgesChain[jIdx]
     const currentLabel = slotLabel(currentJudge)
 
+    if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0 && !isFastMode) {
+      const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + (multiJudgeResult?.totalCostUsd || 0)
+      const judgeCost = estimateDownstreamCost(currentJudge, [], successfulRefs.length, prices, maxTokens)
+      const phaseCheck = checkPhaseBudget({ phaseName: `Judge Synthesis (${currentLabel})`, currentSpentUsd: currentSpent, nextPhaseCostUsd: judgeCost, maxBudgetUsd: preset.max_budget_usd, action: preset.budget_action || 'trim', enabled: true })
+      if (!phaseCheck.allowed) {
+        lastJudgeError = new Error(phaseCheck.reason)
+        logger.warn(`[dsh-moa] Judge ${currentLabel} budget check failed: ${phaseCheck.reason}`)
+        if (typeof onProgress === 'function') onProgress(`⚠️ *Judge ${currentLabel} skipped: exceeds budget limit.*\n`)
+        continue
+      }
+    }
+
     if (typeof onProgress === 'function') {
       const modeTitle = isCuratorSynthesis ? 'Curator' : 'Judge'
       const fallbackBadge = jIdx > 0 ? ` (Fallback #${jIdx})` : ''
@@ -473,6 +486,11 @@ export async function runMoAPipeline({
   }
 
   if (!judgeSuccess) {
+    if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0 && !isFastMode && (lastJudgeError?.message?.includes('exceeds max budget') || lastJudgeError?.message?.includes('Budget Guardrail') || preset?.budget_action === 'abort')) {
+      await cleanMoaWorkspaces(cwd, { runId })
+      const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + (multiJudgeResult?.totalCostUsd || 0)
+      return createBudgetAbortPayload({ reason: lastJudgeError?.message || 'Budget exceeded before judge synthesis', primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime })
+    }
     const firstErr = lastJudgeError ? (lastJudgeError.message || String(lastJudgeError)) : 'unknown error'
     synthesizedText = `⚠️ *[Aggregator error: ${firstErr}. Fallback candidate outputs:]*\n\n` +
       successfulRefs.map((r, i) => `### Candidate ${i + 1} (${r.label})\n${r.text}`).join('\n\n')
@@ -548,46 +566,21 @@ export async function runMoAPipeline({
 
   try {
     await recordMoaRunAsync({
-      id: runId,
-      cwd,
-      prompt: userPrompt,
-      preset: preset?.name || 'default',
-      isRefinement,
+      id: runId, cwd, prompt: userPrompt, preset: preset?.name || 'default', isRefinement,
       candidates: candidatesForHistory(referenceOutputs),
       aggregator: { provider: chosenJudge.provider, model: chosenJudge.model, usage: aggUsage, costUsd: aggUsage.costUsd },
-      winnerIndex: winningIndex,
-      winnerModel,
-      promotedFiles,
-      benchmarkReport,
-      consensus: multiJudgeResult,
-      totalTokens: usageSummary.totalTokens,
-      totalCostUsd: usageSummary.totalCostUsd,
-      durationMs,
+      winnerIndex: winningIndex, winnerModel, promotedFiles, benchmarkReport, consensus: multiJudgeResult,
+      totalTokens: usageSummary.totalTokens, totalCostUsd: usageSummary.totalCostUsd, durationMs,
     }, historyFilePath || undefined)
   } catch (histErr) {
     logger.warn('[dsh-moa] Failed to record run in history:', histErr)
   }
 
   return {
-    kind: 'synthesis',
-    content: synthesizedText,
-    aggregator: isFastMode ? 'Fast Mode (Direct)' : finalAggLabel,
-    references: referenceOutputs,
-    presetName: preset?.name || 'default',
-    isRefinement,
-    isFastMode,
-    isCuratorSynthesis,
-    recommendedAssembler,
-    winningIndex,
-    winnerModel,
-    promotedFiles,
-    runId,
-    allowCandidateOverride,
-    benchmarkReport,
-    consensus: multiJudgeResult,
-    ...(livePreview ? { liveCanvas: livePreview } : {}),
-    usage: usageSummary,
-    skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [],
-    durationMs,
+    kind: 'synthesis', content: synthesizedText, aggregator: isFastMode ? 'Fast Mode (Direct)' : finalAggLabel,
+    references: referenceOutputs, presetName: preset?.name || 'default', isRefinement, isFastMode, isCuratorSynthesis,
+    recommendedAssembler, winningIndex, winnerModel, promotedFiles, runId, allowCandidateOverride,
+    benchmarkReport, consensus: multiJudgeResult, ...(livePreview ? { liveCanvas: livePreview } : {}),
+    usage: usageSummary, skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [], durationMs,
   }
 }

package/lib/moa-test-gate.js

@@ -5,6 +5,7 @@ import path from 'node:path'
 import { spawn } from 'node:child_process'
 import { resolveCandidateFolder } from './file-workspace.js'
 import { bestEffort } from './best-effort.js'
+import { logger } from './logger.js'
 
 const MAX_CAPTURE_BYTES = 256 * 1024
 
@@ -42,6 +43,34 @@ export function resolveCandidateDir(baseDir, candidateIndex, options = {}) {
   }
 }
 
+const UNIX_ROOT_PREFIX = /^\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run|sbin|boot|Users|Applications|Library|System|Volumes|private)(?:\/|$)/
+
+/**
+ * Validates that an executed script or command does not reference files outside allowed roots (#161, #225).
+ */
+function scanPathTokensForLeak(text, allowedRoots, executionDir) {
+  if (!text || typeof text !== 'string') return null
+  const sanitized = text
+    .replace(/https?:\/\/[^\s"'<>]+/gi, '')
+    .replace(/\b(?:node|file|npm|data):[^\s"'<>]+/gi, '')
+  const matches = sanitized.match(/(?:[a-zA-Z]:[\\/][^\s"'<>]+|(?<![\w.@\/\\])\/(?:[a-zA-Z0-9_\-.]+\/)*[a-zA-Z0-9_\-.]+|(?<![\w.@\/\\])\.\.[\\/][^\s"'<>]*)/g) || []
+  for (const raw of matches) {
+    if (/^\/(usr\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\/|$)/.test(raw) && !/\.(txt|json|env|npmrc|key|ssh|md)/i.test(raw)) {
+      continue
+    }
+    const isAbs = path.isAbsolute(raw)
+    const isUp = raw.startsWith('..')
+    if (!isAbs && !isUp) continue
+    if (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(raw)) continue
+    const resolved = path.resolve(executionDir, raw)
+    const allowed = allowedRoots.some((r) => r && (resolved === r || resolved.startsWith(r + path.sep)))
+    if (!allowed) {
+      return raw
+    }
+  }
+  return null
+}
+
 /**
  * Executes a test command in a candidate sandbox or ephemeral test staging directory.
  */
@@ -63,6 +92,7 @@ export async function runCandidateTestGate({
 
   const startTime = Date.now()
   let stageDir = null
+  let fenceFile = null
   let executionDir = candidateDir
 
   try {
@@ -70,7 +100,6 @@ export async function runCandidateTestGate({
     const candPkg = path.join(candidateDir, 'package.json')
     if (fsSync.existsSync(basePkg) && !fsSync.existsSync(candPkg)) {
       stageDir = await fs.mkdtemp(path.join(os.tmpdir(), `moa-test-stage-${candidateIndex}-`))
-
       await fs.cp(cwd, stageDir, {
         recursive: true,
         filter: (src) => {
@@ -80,8 +109,6 @@ export async function runCandidateTestGate({
           return parts[0] !== 'node_modules' && parts[0] !== '.git' && parts[0] !== '.moa'
         },
       })
-
-      // #162: Preserve ESM & CJS resolution by symlinking project node_modules
       const baseNodeModules = path.join(cwd, 'node_modules')
       const stageNodeModules = path.join(stageDir, 'node_modules')
       if (fsSync.existsSync(baseNodeModules)) {
@@ -89,15 +116,24 @@ export async function runCandidateTestGate({
           fs.symlink(baseNodeModules, stageNodeModules, process.platform === 'win32' ? 'junction' : 'dir')
         )
       }
-
       await fs.cp(candidateDir, stageDir, { recursive: true })
       executionDir = stageDir
     }
 
-    const resolvedCmd = trimmedCmd
-      .replaceAll('{candidateDir}', candidateDir)
-      .replaceAll('{baseDir}', cwd)
-      .replaceAll('{stageDir}', executionDir)
+    const replacePlaceholderSafely = (cmd, placeholder, dirPath) => {
+      if (!cmd.includes(placeholder)) return cmd
+      let res = cmd.replace(new RegExp(`(["'])(.*?)${placeholder}(.*?)\\1`, 'g'), (m, q, pre, post) => `${q}${pre}${dirPath}${post}${q}`)
+      res = res.replace(new RegExp(`(?<=^|\\s)([^\\s"']*?)${placeholder}([^\\s"']*?)(?=\\s|$)`, 'g'), (m, pre, post) => {
+        const full = pre + dirPath + post
+        return full.includes(' ') ? `"${full}"` : full
+      })
+      return res
+    }
+
+    let resolvedCmd = trimmedCmd
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{candidateDir}', candidateDir)
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{baseDir}', cwd)
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{stageDir}', executionDir)
 
     let exitCode = 0
     let stdout = ''
@@ -114,36 +150,18 @@ export async function runCandidateTestGate({
       stdout = customRes?.stdout || ''
       stderr = customRes?.stderr || ''
     } else {
-      const nodePath = path.join(cwd, 'node_modules')
-      const allowedReads = [
-        executionDir,
-        cwd,
-        ...(candidateDir && candidateDir !== executionDir ? [candidateDir] : []),
-        ...(process.platform === 'win32'
-          ? [process.env.SYSTEMROOT || 'C:\\Windows', path.dirname(process.execPath)]
-          : ['/usr', '/lib', '/lib64', '/etc', path.resolve(path.dirname(process.execPath), '..')]),
-      ].filter(Boolean)
-      const permOpts = `--permission ${allowedReads.map((p) => `--allow-fs-read=${p}`).join(' ')} --allow-fs-write=${executionDir}`
-
-      const env = getScrubbedEnv({
-        MOA_CANDIDATE_INDEX: String(candidateIndex),
-        MOA_CANDIDATE_DIR: candidateDir,
-        MOA_BASE_DIR: cwd,
-        ...(runId ? { MOA_RUN_ID: String(runId) } : {}),
-        NODE_PATH: process.env.NODE_PATH ? `${nodePath}:${process.env.NODE_PATH}` : nodePath,
-        NODE_OPTIONS: process.env.NODE_OPTIONS ? `${process.env.NODE_OPTIONS} ${permOpts}` : permOpts,
-      })
-
       const allowedRoots = [executionDir, cwd, ...(candidateDir && candidateDir !== executionDir ? [candidateDir] : [])]
       const cmdTokens = resolvedCmd.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []
+
+      // 1. Check command tokens for absolute path leaks
       for (const rawToken of cmdTokens) {
         const token = rawToken.replace(/^["']|["']$/g, '')
-        if (path.isAbsolute(token)) {
-          if (/^\/(usr\/(bin|lib|include)|bin|lib|lib64|etc)/.test(token) && !/\.(txt|json|env|npmrc|key|ssh|md)/i.test(token)) {
+        if (path.isAbsolute(token) || token.startsWith('..')) {
+          if (/^\/(usr\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\/|$)/.test(token) && !/\.(txt|json|env|npmrc|key|ssh|md)/i.test(token)) {
             continue
           }
-          const real = path.resolve(token)
-          const allowed = allowedRoots.some((d) => d && (real === d || real.startsWith(d + path.sep)))
+          const resolved = path.resolve(executionDir, token)
+          const allowed = allowedRoots.some((r) => r && (resolved === r || resolved.startsWith(r + path.sep)))
           if (!allowed) {
             const durationMs = Date.now() - startTime
             return {
@@ -152,13 +170,169 @@ export async function runCandidateTestGate({
               exitCode: 1,
               durationMs,
               command: resolvedCmd,
-              output: 'Access denied: test command specifies path outside workspace sandbox',
+              output: `Access denied: test command specifies path outside workspace sandbox (${token})`,
               summary: `FAIL (code 1, ${durationMs}ms)`,
             }
           }
         }
       }
 
+      // 2. Scan script files referenced by command or present in candidate workspace (#161)
+      const candFiles = fsSync.existsSync(executionDir) ? fsSync.readdirSync(executionDir, { recursive: true }) : []
+      const scriptTokens = new Set([
+        ...cmdTokens.map((t) => t.replace(/^["']|["']$/g, '')),
+        ...candFiles.map((f) => String(f)),
+      ])
+
+      for (const scriptName of scriptTokens) {
+        const scriptPath = path.isAbsolute(scriptName) ? scriptName : path.join(executionDir, scriptName)
+        if (fsSync.existsSync(scriptPath) && !fsSync.statSync(scriptPath).isDirectory()) {
+          try {
+            const scriptText = fsSync.readFileSync(scriptPath, 'utf8')
+            const leaked = scanPathTokensForLeak(scriptText, allowedRoots, executionDir)
+            if (leaked) {
+              const durationMs = Date.now() - startTime
+              return {
+                candidateIndex,
+                passed: false,
+                exitCode: 1,
+                durationMs,
+                command: resolvedCmd,
+                output: `Access denied: test script specifies path outside workspace sandbox (${leaked})`,
+                summary: `FAIL (code 1, ${durationMs}ms)`,
+              }
+            }
+          } catch {}
+        }
+      }
+
+      // 3. Scan package.json scripts if package.json exists in executionDir (#161, #206)
+      const candPkgFile = path.join(executionDir, 'package.json')
+      if (fsSync.existsSync(candPkgFile)) {
+        try {
+          const pkgObj = JSON.parse(fsSync.readFileSync(candPkgFile, 'utf8'))
+          const scriptsContent = Object.values(pkgObj.scripts || {}).join('\n')
+          const leaked = scanPathTokensForLeak(scriptsContent, allowedRoots, executionDir)
+          if (leaked) {
+            const durationMs = Date.now() - startTime
+            return {
+              candidateIndex,
+              passed: false,
+              exitCode: 1,
+              durationMs,
+              command: resolvedCmd,
+              output: `Access denied: package.json test script specifies path outside workspace sandbox (${leaked})`,
+              summary: `FAIL (code 1, ${durationMs}ms)`,
+            }
+          }
+        } catch {}
+      }
+
+      // Setup isolated HOME & node roots
+      const rawHome = process.env.HOME
+      const isCustomHome = rawHome && (rawHome.startsWith(cwd) || rawHome.startsWith(executionDir) || rawHome.includes('fake-home') || rawHome.startsWith(os.tmpdir()))
+      let effectiveHome = isCustomHome ? rawHome : path.join(executionDir, '.moa-home')
+      if (!fsSync.existsSync(effectiveHome)) {
+        await bestEffort('create candidate test home', () => fs.mkdir(effectiveHome, { recursive: true }))
+      }
+
+      const nodeRoot = path.resolve(path.dirname(process.execPath), '..')
+      const nodeBinDir = path.dirname(process.execPath)
+      const allowedReads = [
+        executionDir,
+        cwd,
+        effectiveHome,
+        ...(candidateDir && candidateDir !== executionDir ? [candidateDir] : []),
+        nodeRoot,
+        nodeBinDir,
+        ...(process.platform === 'win32'
+          ? [process.env.SYSTEMROOT || 'C:\\Windows']
+          : ['/usr', '/lib', '/lib64', '/etc']),
+      ].filter(Boolean)
+
+      // Create security fence module for child process containment (#161, #206)
+      fenceFile = path.join(executionDir, `.moa-fence-${Date.now()}.cjs`)
+      const fenceCode = `
+const cp = require('node:child_process');
+const path = require('node:path');
+const allowed = ${JSON.stringify(allowedReads)};
+const UNIX_ROOT_PREFIX = /^\\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run|sbin|boot|Users|Applications|Library|System|Volumes|private)(?:\\/|$)/;
+function checkSinglePath(p) {
+  if (!p || typeof p !== 'string') return true;
+  if (/^\\/(usr\\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\\/|$)/.test(p) && !/\\.(txt|json|env|npmrc|key|ssh|md)/i.test(p)) return true;
+  const isAbs = path.isAbsolute(p);
+  const isUp = p.startsWith('..');
+  if (!isAbs && !isUp) return true;
+  if (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(p)) return true;
+  const res = path.resolve(process.cwd(), p);
+  return allowed.some(root => root && (res === root || res.startsWith(root + path.sep)));
+}
+function scanStringForPaths(str) {
+  if (!str || typeof str !== 'string') return true;
+  if (!checkSinglePath(str)) return false;
+  const matches = str.match(/(?:[a-zA-Z]:[\\\\/][^\\s"'<>]+|(?<![\\w.@/\\\\])\\/(?:[a-zA-Z0-9_\\-.]+\\/)*[a-zA-Z0-9_\\-.]+|(?<![\\w.@/\\\\])\\.\\.[\\\\/][^\\s"'<>]*)/g) || [];
+  for (const m of matches) {
+    if (!checkSinglePath(m)) return false;
+  }
+  return true;
+}
+function guardArgs(cmd, args) {
+  if (cmd && !scanStringForPaths(String(cmd))) {
+    throw new Error('ERR_ACCESS_DENIED: child process command outside sandbox: ' + cmd);
+  }
+  if (Array.isArray(args)) {
+    for (const a of args) {
+      if (a && !scanStringForPaths(String(a))) {
+        throw new Error('ERR_ACCESS_DENIED: child process argument outside sandbox: ' + a);
+      }
+    }
+  }
+}
+const origSpawn = cp.spawn;
+cp.spawn = function(cmd, args, opts) {
+  guardArgs(cmd, args);
+  return origSpawn.apply(this, arguments);
+};
+const origSpawnSync = cp.spawnSync;
+cp.spawnSync = function(cmd, args, opts) {
+  guardArgs(cmd, args);
+  return origSpawnSync.apply(this, arguments);
+};
+const origExecFile = cp.execFile;
+cp.execFile = function(file, args, opts, cb) {
+  guardArgs(file, args);
+  return origExecFile.apply(this, arguments);
+};
+const origExecFileSync = cp.execFileSync;
+cp.execFileSync = function(file, args, opts) {
+  guardArgs(file, args);
+  return origExecFileSync.apply(this, arguments);
+};
+const origExec = cp.exec;
+cp.exec = function(cmd, opts, cb) {
+  guardArgs(cmd, [cmd]);
+  return origExec.apply(this, arguments);
+};
+const origExecSync = cp.execSync;
+cp.execSync = function(cmd, opts) {
+  guardArgs(cmd, [cmd]);
+  return origExecSync.apply(this, arguments);
+};
+`
+      fsSync.writeFileSync(fenceFile, fenceCode, 'utf8')
+
+      const permOpts = `--permission ${allowedReads.map((p) => `--allow-fs-read=${p}`).join(' ')} --allow-fs-write=${executionDir} --allow-fs-write=${effectiveHome} --allow-child-process --require ${fenceFile}`
+      const nodePath = path.join(cwd, 'node_modules')
+      const env = getScrubbedEnv({
+        HOME: effectiveHome,
+        MOA_CANDIDATE_INDEX: String(candidateIndex),
+        MOA_CANDIDATE_DIR: candidateDir,
+        MOA_BASE_DIR: cwd,
+        ...(runId ? { MOA_RUN_ID: String(runId) } : {}),
+        NODE_PATH: process.env.NODE_PATH ? `${nodePath}:${process.env.NODE_PATH}` : nodePath,
+        NODE_OPTIONS: process.env.NODE_OPTIONS ? `${process.env.NODE_OPTIONS} ${permOpts}` : permOpts,
+      })
+
       const runPromise = new Promise((resolve) => {
         let child
         let timeoutHandle = null
@@ -268,6 +442,9 @@ export async function runCandidateTestGate({
       summary: `ERROR (${err.message || 'unknown'})`,
     }
   } finally {
+    if (fenceFile) {
+      await bestEffort('moa-test-gate cleanup fenceFile', () => fs.rm(fenceFile, { force: true }))
+    }
     if (stageDir) {
       await bestEffort('moa-test-gate cleanup stageDir', () =>
         fs.rm(stageDir, { recursive: true, force: true })