@goodandready/dsh-moa 0.2.46 → 0.2.47

package/README.md

@@ -150,7 +150,7 @@ Inspect line-by-line differences between candidate proposals and the curator's s
 Before promoting any winning candidate files over the workspace root, `dsh-moa` invokes the local `dsh-time-machine` service to create a shadow Git checkpoint (`moa-pre-promotion: candidate-N`). If `dsh-time-machine` is absent or unreachable, file promotion is blocked (fail-closed) to protect uncheckpointed workspace files against unintended overwrites (override with `force: true` only when automated checkpoints are explicitly unneeded).
 
 ### 9. Automated Test Execution Gate
-When `test_gate_enabled: true` and `test_command` (e.g. `npm test` or `pytest`) are configured, candidate code is executed in an ephemeral sandbox overlay. The judge receives concrete test outcomes, durations, and output logs to ground decisions in objective verification.
+When `test_gate_enabled: true` and `test_command` (e.g. `npm test` or `pytest`) are configured, candidate code is executed in an ephemeral sandbox overlay. The test sandbox uses process containment fences and path validation to block unauthorized host file access and computed shell evasion (base64/eval/pipes), while allowing safe HTTP route literals. The judge receives concrete test outcomes, durations, and output logs to ground decisions in objective verification.
 
 ### 10. Multi-Judge Panel & Consensus Voting
 When `multi_judge_enabled: true`, candidate solutions are independently evaluated by a panel of judge models. Winner selection supports `majority`, `highest_score`, or `unanimous` consensus strategies.
@@ -165,7 +165,7 @@ When invoking `/moa` without explicit preset flags, the router classifies prompt
 As each candidate completes, live token counts and USD costs are streamed directly into the chat based on catalog pricing and vendor rates.
 
 ### 14. Cost Budget Guardrails (Trim & Abort Modes)
-`budget_guard_enabled` and `max_budget_usd` guard against accidental spend. Mode `trim` automatically reduces the candidate pool to fit the budget, while `abort` cancels execution before token consumption.
+`budget_guard_enabled` and `max_budget_usd` guard against accidental spend. Upfront and runtime phase guards account for candidate generation, multi-judge panel voting, and downstream synthesis prompt overhead including custom evaluation criteria (`judge_criteria`). Mode `trim` automatically reduces the candidate pool to fit the budget, while `abort` cancels execution before token consumption. In abort payloads, all panel and candidate token metrics are fully preserved.
 
 ### 15. Temperature Gradient Exploration & Per-Candidate Temperature
 Supports individual candidate temperatures (`slot.temperature`) and `temperature_gradient_enabled` to distribute temperatures (0.2 → 0.9) across candidates for maximum architectural diversity.

package/README.ru.md

@@ -150,7 +150,7 @@ graph TD
 Перед промоушном файлов победителя в корень рабочей области `dsh-moa` автоматически обращается к сервису `dsh-time-machine` для создания снимка (`moa-pre-promotion: candidate-N`). Если плагин недоступен или создание снимка завершилось ошибкой, перезапись файлов блокируется во избежание потери несохранённых данных (переопределяется параметром `force: true`, только если создание снимков намеренно отключено).
 
 ### 9. Автоматический шлюз выполнения тестов (Automated Test Execution Gate)
-При включении `test_gate_enabled: true` и указании тестовой команды (`test_command`, например `npm test` или `pytest`) каждый кандидат запускается в изолированном оверлейном окружении. Судья получает объективный вердикт с кодами возврата, временем исполнения и логами тестов до вынесения итогового решения.
+При включении `test_gate_enabled: true` и указании тестовой команды (`test_command`, например `npm test` или `pytest`) каждый кандидат запускается в изолированном оверлейном окружении с защитой от выхода за пределы песочницы (блокировка вычисляемых shell-команд base64/eval/pipes при сохранении безопасных строковых REST-маршрутов). Судья получает объективный вердикт с кодами возврата, временем исполнения и логами тестов до вынесения итогового решения.
 
 ### 10. Коллегия судей и консенсусное голосование (Multi-Judge Panel)
 При активации опции `multi_judge_enabled` решения кандидатов оценивает независимая панель судейских моделей с поддержкой стратегий голосования: `majority` (большинство), `highest_score` (наивысший средний балл) или `unanimous` (единогласный консенсус).
@@ -165,7 +165,7 @@ graph TD
 По мере завершения каждого кандидата плагин в реальном времени транслирует в чат накопленный расход токенов и расчетную стоимость в USD на базе встроенного каталога тарифов OpenRouter и прямых цен провайдеров.
 
 ### 14. Бюджетные ограничения расходов (Cost Budget Guardrails)
-Опция `budget_guard_enabled` с лимитом `max_budget_usd` защищает от непредвиденных трат: режим `trim` автоматически сокращает пул кандидатов до самых экономичных моделей, укладывающихся в бюджет, а режим `abort` прерывает выполнение до начала генерации.
+Опция `budget_guard_enabled` с лимитом `max_budget_usd` защищает от непредвиденных трат. Упреждающие и пофазные проверки учитывают генерацию кандидатов, панель судей и оверхед промпта синтеза с учётом пользовательских критериев (`judge_criteria`). Режим `trim` автоматически сокращает пул кандидатов до самых экономичных моделей, укладывающихся в бюджет, а режим `abort` прерывает выполнение до начала генерации. При прерывании полностью сохраняются метрики токенов кандидатов и мульти-судейской панели.
 
 ### 15. Градиент температурной диверсификации и точечная температура
 Поддерживается как индивидуальная настройка температуры для каждого кандидата (`slot.temperature`), так и опция `temperature_gradient_enabled`, автоматически распределяющая температуры кандидатов по шкале от 0.2 до 0.9 для достижения максимального разнообразия инженерных подходов.

package/lib/client.js

@@ -119,6 +119,7 @@ window.__ModuleLoader__.load({
       'actions.save': 'Save Configuration',
       'actions.saving': 'Saving…',
       'actions.saved': 'Configuration saved successfully!',
+      'actions.saved_memory_only': 'Saved to session memory only (not persisted to disk)',
       'actions.retry': 'Reload Configuration',
       'badge.disabled': 'MoA Disabled',
       'config.enabled_label': 'Enable MoA (slash command and turn routing)',
@@ -297,6 +298,7 @@ window.__ModuleLoader__.load({
       'actions.save': '保存配置',
       'actions.saving': '正在保存…',
       'actions.saved': '配置已成功保存！',
+      'actions.saved_memory_only': '已保存到会话内存（未持久化到磁盘）',
       'actions.retry': '重新加载配置',
       'badge.disabled': 'MoA 已禁用',
       'config.enabled_label': '启用 MoA（斜杠命令与轮次拦截路由）',
@@ -2566,7 +2568,11 @@ window.__ModuleLoader__.load({
           .then((r) => r.json())
           .then((res) => {
             if (res && res.ok) {
-              setSaveStatus(t('actions.saved'))
+              if (res.persisted === false) {
+                setSaveStatus(t('actions.saved_memory_only'))
+              } else {
+                setSaveStatus(t('actions.saved'))
+              }
               if (Array.isArray(res.presets)) setPresets(res.presets)
               if (res.defaultPreset) setDefaultPreset(res.defaultPreset)
               setTimeout(() => setSaveStatus(''), 3000)

package/lib/index.js

@@ -108,7 +108,7 @@ export function apply(ctx, config) {
         if (config[k] && typeof config[k] === 'object' && typeof config[k].get === 'function') continue
         const desc = Object.getOwnPropertyDescriptor(config, k)
         if (desc && desc.get && !desc.set) continue
-        try { config[k] = v } catch {}
+        bestEffort('update in-memory config key', () => { config[k] = v }, ctx.logger)
       }
     }
     let liveCandidate = ctx.fiber?.config

package/lib/moa-budget.js

@@ -66,6 +66,35 @@ export function estimateRound2Cost(candidates = [], prices = {}, expectedOutputT
   return r2Total
 }
 
+/**
+ * Estimates upfront token cost for multi-judge consensus panel (#158).
+ */
+export function estimatePanelCost(judges = [], numCandidates = 1, prices = {}, maxTokens = 2048, promptTokens = 500) {
+  if (!Array.isArray(judges) || judges.length === 0 || numCandidates <= 1) return 0
+  let totalCost = 0
+  const inputTokens = promptTokens + (maxTokens * numCandidates) + 150
+  const outputTokens = Math.min(maxTokens, 1024)
+  for (const j of judges) {
+    if (j?.provider && j?.model) {
+      const cost = estimateTokenCost(j, { inputTokens, outputTokens }, prices)?.costUsd || 0
+      totalCost += cost
+    }
+  }
+  return totalCost
+}
+
+/**
+ * Calculates accurate synthesis prompt tokens accounting for full user prompt,
+ * judge criteria, and reference candidate texts (#158).
+ */
+export function calcSynthesisPromptTokens(userPrompt = '', referenceOutputs = [], judgeCriteria = '', overhead = 2600) {
+  const promptChars = (typeof userPrompt === 'string' ? userPrompt.length : 0) +
+    (typeof judgeCriteria === 'string' ? judgeCriteria.length : 0) +
+    (Array.isArray(referenceOutputs) ? referenceOutputs.reduce((acc, r) => acc + (r.text?.length || 0), 0) : 0) +
+    overhead
+  return Math.max(50, Math.ceil(promptChars / 4))
+}
+
 /**
  * Phase-by-phase runtime budget check (#158).
  * Checks if current spent + next phase estimate would exceed budget.
@@ -108,6 +137,7 @@ export function applyBudgetGuardrails({
   promptLength = 1000,
   projectContext = '',
   messages = [],
+  judgeCriteria = '',
   maxTokens = 2048,
   peerCritiqueEnabled = false,
   aggregator = null,
@@ -122,8 +152,11 @@ export function applyBudgetGuardrails({
     }
   }
 
-  // Calculate full input tokens from userPrompt length + messages context + system prompt overhead
+  // Calculate full input tokens from userPrompt length + judgeCriteria + messages context + system prompt overhead
   let contextChars = Number(promptLength) || 1000
+  if (typeof judgeCriteria === 'string' && judgeCriteria.length > 0 && !String(promptLength).includes(String(judgeCriteria.length))) {
+    contextChars += judgeCriteria.length
+  }
   if (typeof projectContext === 'string' && projectContext.length > 0 && !String(promptLength).includes(String(projectContext.length))) {
     contextChars += projectContext.length
   }
@@ -245,8 +278,11 @@ export function createBudgetAbortPayload({
   isFastMode = false,
   collectedCtx = {},
   startTime = Date.now(),
+  multiJudgeResult = null,
 }) {
   const aggLabel = (primaryJudge?.provider && primaryJudge?.model) ? `${primaryJudge.provider}:${primaryJudge.model}` : "none";
+  const refTokens = referenceOutputs.reduce((acc, r) => acc + (r.usage?.totalTokens || 0), 0);
+  const panelTokens = multiJudgeResult?.totalUsage?.totalTokens || 0;
   return {
     kind: "failure",
     content: `🛑 Budget Guardrail Abort: ${reason}`,
@@ -259,11 +295,13 @@ export function createBudgetAbortPayload({
     winnerModel: "none",
     promotedFiles: [],
     usage: {
-      totalTokens: referenceOutputs.reduce((acc, r) => acc + (r.usage?.totalTokens || 0), 0),
+      totalTokens: refTokens + panelTokens,
       totalCostUsd: Number(currentSpentUsd.toFixed(5)),
       candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
       aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 },
+      ...(multiJudgeResult ? { multiJudge: multiJudgeResult.totalUsage || { totalTokens: panelTokens } } : {}),
     },
+    multiJudgeResult: multiJudgeResult || undefined,
     skippedFiles: collectedCtx?.skippedFiles || 0,
     skippedList: collectedCtx?.skippedList || [],
     durationMs: Date.now() - startTime,

package/lib/moa-llm.js

@@ -26,7 +26,7 @@ function combineSignals(signal, timeoutSignal) {
  */
 
 export function createLlmCaller(ctx) {
-  return async ({ provider, model, messages, temperature = 0.6, maxTokens = 4096, timeoutMs, onStreamDelta, signal, stop, reasoningEffort }) => {
+  return async ({ provider, model, messages, temperature = 0.6, maxTokens = 2048, timeoutMs, onStreamDelta, signal, stop, reasoningEffort }) => {
     if (!ctx.llm) {
       throw new Error('ctx.llm is not available in cordis context')
     }

package/lib/moa-multi-judge.js

@@ -5,6 +5,7 @@
 
 import { slotLabel } from './moa-prompts.js'
 import { estimateTokenCost } from './pricing.js'
+import { estimatePanelCost, estimateDownstreamCost, checkPhaseBudget, calcSynthesisPromptTokens } from './moa-budget.js'
 
 /**
  * Extracts code fences and block-level assets from markdown text.
@@ -160,6 +161,7 @@ export async function executeMultiJudgePanel({
   onProgress,
   prices = {},
   blind = false,
+  maxTokens = 2048,
 }) {
   const activeCandidates = (candidates || []).filter((c) => c && c.ok)
   if (activeCandidates.length === 0) {
@@ -240,6 +242,7 @@ CONSENSUS_REASONING: [one concise sentence explaining your pick]
           { role: 'system', content: 'You are an objective AI code evaluation judge.' },
           { role: 'user', content: judgePrompt },
         ],
+        maxTokens,
         signal: abortCtrl.signal,
       })
 
@@ -392,3 +395,64 @@ CONSENSUS_REASONING: [one concise sentence explaining your pick]
     consensusReport,
   }
 }
+
+
+/**
+ * Runs the Multi-Judge consensus phase with budget pre-checking (#158, #168).
+ */
+export async function runMultiJudgePhase({
+  preset = {},
+  successfulRefs = [],
+  primaryJudge,
+  userPrompt = '',
+  judgeCriteria = '',
+  prices = {},
+  maxTokens = 2048,
+  callLlm,
+  signal,
+  onProgress,
+  currentSpent = 0,
+}) {
+  if (!preset?.multi_judge_enabled || successfulRefs.length <= 1) {
+    return { skipped: true, result: null }
+  }
+  const panelJudges = (preset.judge_models && preset.judge_models.length > 0) ? preset.judge_models : [primaryJudge]
+  const panelMaxTokens = Math.min(typeof preset.max_tokens === 'number' && preset.max_tokens > 0 ? preset.max_tokens : 2048, 2048)
+
+  if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0) {
+    const promptTokens = calcSynthesisPromptTokens(userPrompt, successfulRefs, judgeCriteria)
+    const panelEst = estimatePanelCost(panelJudges, successfulRefs.length, prices, panelMaxTokens, promptTokens)
+    const downEst = estimateDownstreamCost(primaryJudge, [], successfulRefs.length, prices, maxTokens, promptTokens)
+    const phaseCheck = checkPhaseBudget({
+      phaseName: 'Multi-Judge Panel',
+      currentSpentUsd: currentSpent,
+      nextPhaseCostUsd: panelEst + downEst,
+      maxBudgetUsd: preset.max_budget_usd,
+      action: preset.budget_action || 'trim',
+      enabled: true,
+    })
+    if (!phaseCheck.allowed) {
+      if (preset.budget_action === 'abort') {
+        return { abort: true, reason: phaseCheck.reason }
+      }
+      if (typeof onProgress === 'function') {
+        onProgress(`✂️ *Skipping Multi-Judge Panel to stay within budget ($${preset.max_budget_usd.toFixed(4)})*\n`)
+      }
+      return { skipped: true, result: null }
+    }
+  }
+
+  const result = await executeMultiJudgePanel({
+    judges: panelJudges,
+    candidates: successfulRefs,
+    userPrompt,
+    callLlm,
+    strategy: preset.judge_voting_strategy || 'majority',
+    prices: prices || {},
+    blind: Boolean(preset.blind_evaluation),
+    maxTokens: panelMaxTokens,
+    signal,
+    onProgress,
+  })
+  return { skipped: false, result }
+}

package/lib/moa-runner.js

@@ -8,8 +8,8 @@ import { slotLabel, isBroadPromptRequiringQuestions, buildQuestionSynthesisPromp
 import { parseWinnerIndex, parseRecommendedAssembler } from './moa-parser.js'
 import { REFERENCE_SYSTEM_PROMPT, callWithTransientRetry, runReferencesParallel } from './moa-candidates.js'
 import { executeTestGateForCandidates } from './moa-test-gate.js'
-import { executeMultiJudgePanel, buildCompositeBlockDirectives } from './moa-multi-judge.js'
-import { applyBudgetGuardrails, checkPhaseBudget, estimateRound2Cost, estimateDownstreamCost, createBudgetAbortPayload } from './moa-budget.js'
+import { executeMultiJudgePanel, buildCompositeBlockDirectives, runMultiJudgePhase } from './moa-multi-judge.js'
+import { applyBudgetGuardrails, checkPhaseBudget, estimateRound2Cost, estimateDownstreamCost, calcSynthesisPromptTokens, createBudgetAbortPayload } from './moa-budget.js'
 import { extractPriorTurnBaseline, pruneMultiTurnMessages } from './moa-context.js'
 import { generateMoABenchmarkReport } from './moa-report.js'
 // Re-exports for consumers & backward compatibility
@@ -80,7 +80,8 @@ export async function runMoAPipeline({
     maxBudgetUsd: preset?.max_budget_usd,
     action: preset?.budget_action || 'trim',
     prices,
-    promptLength: (userPrompt?.length || 1000) + (projectContext ? projectContext.length : 0),
+    promptLength: (userPrompt?.length || 1000) + (judgeCriteria?.length || 0) + (projectContext ? projectContext.length : 0),
+    judgeCriteria,
     projectContext,
     messages,
     maxTokens,
@@ -384,19 +385,15 @@ export async function runMoAPipeline({
     return { error: new Error('Turn aborted') }
   }
 
-  if (preset?.multi_judge_enabled && successfulRefs.length > 1) {
-    multiJudgeResult = await executeMultiJudgePanel({
-      judges: (preset.judge_models && preset.judge_models.length > 0) ? preset.judge_models : [primaryJudge],
-      candidates: successfulRefs,
-      userPrompt,
-      callLlm,
-      strategy: preset.judge_voting_strategy || 'majority',
-      prices: prices || {},
-      blind: Boolean(preset.blind_evaluation),
-      signal,
-      onProgress,
-    })
+  const currentRefSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0)
+  const panelPhase = await runMultiJudgePhase({
+    preset, successfulRefs, primaryJudge, userPrompt, judgeCriteria, prices, maxTokens, callLlm, signal, onProgress, currentSpent: currentRefSpent,
+  })
+  if (panelPhase.abort) {
+    await cleanMoaWorkspaces(cwd, { runId })
+    return createBudgetAbortPayload({ reason: panelPhase.reason, primaryJudge, referenceOutputs, currentSpentUsd: currentRefSpent, preset, isRefinement, isFastMode, collectedCtx, startTime })
   }
+  multiJudgeResult = panelPhase.result
 
   // 7d. Feature 3: Composite Block Merge Directive
   const compositeMergeDirective = (preset?.composite_merge_enabled && successfulRefs.length > 1)
@@ -404,13 +401,14 @@ export async function runMoAPipeline({
     : null
 
   // 8. Synthesis phase via primary judge or fallback chain
+  const synthPromptTokens = calcSynthesisPromptTokens(userPrompt, successfulRefs, judgeCriteria)
   if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0 && !isFastMode) {
     const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + (multiJudgeResult?.totalCostUsd || 0)
-    const downNext = estimateDownstreamCost(primaryJudge, [], successfulRefs.length, prices, maxTokens)
+    const downNext = estimateDownstreamCost(primaryJudge, [], successfulRefs.length, prices, maxTokens, synthPromptTokens)
     const phaseCheck = checkPhaseBudget({ phaseName: 'Judge Synthesis', currentSpentUsd: currentSpent, nextPhaseCostUsd: downNext, maxBudgetUsd: preset.max_budget_usd, action: preset.budget_action || 'trim', enabled: true })
     if (!phaseCheck.allowed && fallbackJudges.length === 0) {
       await cleanMoaWorkspaces(cwd, { runId })
-      return createBudgetAbortPayload({ reason: phaseCheck.reason, primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime })
+      return createBudgetAbortPayload({ reason: phaseCheck.reason, primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime, multiJudgeResult })
     }
   }
   const synthesisPrompt = buildSynthesisPrompt(userPrompt, referenceOutputs, judgeCriteria, {
@@ -432,7 +430,7 @@ export async function runMoAPipeline({
 
     if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0 && !isFastMode) {
       const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + (multiJudgeResult?.totalCostUsd || 0)
-      const judgeCost = estimateDownstreamCost(currentJudge, [], successfulRefs.length, prices, maxTokens)
+      const judgeCost = estimateDownstreamCost(currentJudge, [], successfulRefs.length, prices, maxTokens, synthPromptTokens)
       const phaseCheck = checkPhaseBudget({ phaseName: `Judge Synthesis (${currentLabel})`, currentSpentUsd: currentSpent, nextPhaseCostUsd: judgeCost, maxBudgetUsd: preset.max_budget_usd, action: preset.budget_action || 'trim', enabled: true })
       if (!phaseCheck.allowed) {
         lastJudgeError = new Error(phaseCheck.reason)
@@ -489,7 +487,7 @@ export async function runMoAPipeline({
     if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0 && !isFastMode && (lastJudgeError?.message?.includes('exceeds max budget') || lastJudgeError?.message?.includes('Budget Guardrail') || preset?.budget_action === 'abort')) {
       await cleanMoaWorkspaces(cwd, { runId })
       const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + (multiJudgeResult?.totalCostUsd || 0)
-      return createBudgetAbortPayload({ reason: lastJudgeError?.message || 'Budget exceeded before judge synthesis', primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime })
+      return createBudgetAbortPayload({ reason: lastJudgeError?.message || 'Budget exceeded before judge synthesis', primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime, multiJudgeResult })
     }
     const firstErr = lastJudgeError ? (lastJudgeError.message || String(lastJudgeError)) : 'unknown error'
     synthesizedText = `⚠️ *[Aggregator error: ${firstErr}. Fallback candidate outputs:]*\n\n` +

package/lib/moa-test-gate.js

@@ -43,7 +43,9 @@ export function resolveCandidateDir(baseDir, candidateIndex, options = {}) {
   }
 }
 
-const UNIX_ROOT_PREFIX = /^\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run|sbin|boot|Users|Applications|Library|System|Volumes|private)(?:\/|$)/
+const COMPUTED_SHELL_EVASION = /(?:base64\s+(?:-d|--decode|-D)|\beval\s+["\']?\$|\bxxd\s+-r|\bprintf\s+[^|\n]+\|\s*(?:ba|z|da)?sh|\bopenssl\s+enc\s+-d)/i
+
+const UNIX_ROOT_PREFIX = /^\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run\/(?:user|systemd|lock|credentials|secrets|udev|initramfs|mount|shm|dbus|sshd|motd)|sbin|boot|Users\/(?:[a-zA-Z0-9_\-.]+)|Applications|Library|System|Volumes|private)(?:\/|$)/
 
 /**
  * Validates that an executed script or command does not reference files outside allowed roots (#161, #225).
@@ -189,6 +191,18 @@ export async function runCandidateTestGate({
         if (fsSync.existsSync(scriptPath) && !fsSync.statSync(scriptPath).isDirectory()) {
           try {
             const scriptText = fsSync.readFileSync(scriptPath, 'utf8')
+            if (COMPUTED_SHELL_EVASION.test(scriptText)) {
+              const durationMs = Date.now() - startTime
+              return {
+                candidateIndex,
+                passed: false,
+                exitCode: 1,
+                durationMs,
+                command: resolvedCmd,
+                output: 'Access denied: test script contains obfuscated or computed command execution',
+                summary: `FAIL (code 1, ${durationMs}ms)`,
+              }
+            }
             const leaked = scanPathTokensForLeak(scriptText, allowedRoots, executionDir)
             if (leaked) {
               const durationMs = Date.now() - startTime
@@ -202,7 +216,9 @@ export async function runCandidateTestGate({
                 summary: `FAIL (code 1, ${durationMs}ms)`,
               }
             }
-          } catch {}
+          } catch (scanErr) {
+            logger.debug('[dsh-moa:testGate] candidate script read error:', scanErr?.message || scanErr)
+          }
         }
       }
 
@@ -212,6 +228,18 @@ export async function runCandidateTestGate({
         try {
           const pkgObj = JSON.parse(fsSync.readFileSync(candPkgFile, 'utf8'))
           const scriptsContent = Object.values(pkgObj.scripts || {}).join('\n')
+          if (COMPUTED_SHELL_EVASION.test(scriptsContent)) {
+            const durationMs = Date.now() - startTime
+            return {
+              candidateIndex,
+              passed: false,
+              exitCode: 1,
+              durationMs,
+              command: resolvedCmd,
+              output: 'Access denied: package.json test script contains obfuscated or computed command execution',
+              summary: `FAIL (code 1, ${durationMs}ms)`,
+            }
+          }
           const leaked = scanPathTokensForLeak(scriptsContent, allowedRoots, executionDir)
           if (leaked) {
             const durationMs = Date.now() - startTime
@@ -225,7 +253,9 @@ export async function runCandidateTestGate({
               summary: `FAIL (code 1, ${durationMs}ms)`,
             }
           }
-        } catch {}
+        } catch (pkgErr) {
+          logger.debug('[dsh-moa:testGate] candidate package.json read error:', pkgErr?.message || pkgErr)
+        }
       }
 
       // Setup isolated HOME & node roots
@@ -245,6 +275,8 @@ export async function runCandidateTestGate({
         ...(candidateDir && candidateDir !== executionDir ? [candidateDir] : []),
         nodeRoot,
         nodeBinDir,
+        ...(process.env.NVM_DIR ? [process.env.NVM_DIR] : []),
+        ...(nodeRoot.includes("/.nvm/") ? [path.resolve(nodeRoot, "../..")] : []),
         ...(process.platform === 'win32'
           ? [process.env.SYSTEMROOT || 'C:\\Windows']
           : ['/usr', '/lib', '/lib64', '/etc']),
@@ -256,7 +288,8 @@ export async function runCandidateTestGate({
 const cp = require('node:child_process');
 const path = require('node:path');
 const allowed = ${JSON.stringify(allowedReads)};
-const UNIX_ROOT_PREFIX = /^\\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run|sbin|boot|Users|Applications|Library|System|Volumes|private)(?:\\/|$)/;
+const COMPUTED_SHELL_EVASION = /(?:base64\\s+(?:-d|--decode|-D)|\\beval\\s+["\']?\\$|\\bxxd\\s+-r|\\bprintf\\s+[^|\\n]+\\|\\s*(?:ba|z|da)?sh|\\bopenssl\\s+enc\\s+-d)/i;
+const UNIX_ROOT_PREFIX = /^\\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run\\/(?:user|systemd|lock|credentials|secrets|udev|initramfs|mount|shm|dbus|sshd|motd)|sbin|boot|Users\\/(?:[a-zA-Z0-9_\\-.]+)|Applications|Library|System|Volumes|private)(?:\\/|$)/;
 function checkSinglePath(p) {
   if (!p || typeof p !== 'string') return true;
   if (/^\\/(usr\\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\\/|$)/.test(p) && !/\\.(txt|json|env|npmrc|key|ssh|md)/i.test(p)) return true;
@@ -277,6 +310,10 @@ function scanStringForPaths(str) {
   return true;
 }
 function guardArgs(cmd, args) {
+  const full = [cmd, ...(Array.isArray(args) ? args : [])].join(' ');
+  if (COMPUTED_SHELL_EVASION.test(full)) {
+    throw new Error('ERR_ACCESS_DENIED: child process computed execution pattern blocked: ' + full);
+  }
   if (cmd && !scanStringForPaths(String(cmd))) {
     throw new Error('ERR_ACCESS_DENIED: child process command outside sandbox: ' + cmd);
   }
@@ -318,6 +355,20 @@ cp.execSync = function(cmd, opts) {
   guardArgs(cmd, [cmd]);
   return origExecSync.apply(this, arguments);
 };
+const fsMod = require('node:fs');
+function guardFs(p, isWrite) {
+  if (!p || typeof p !== 'string') return;
+  const isAbs = path.isAbsolute(p);
+  const isUp = p.startsWith('..');
+  if (!isAbs && !isUp) return;
+  const resolved = path.resolve(process.cwd(), p);
+  const checkRoots = isWrite ? [process.cwd(), process.env.HOME].filter(Boolean) : allowed;
+  const ok = checkRoots.some(r => r && (resolved === r || resolved.startsWith(r + path.sep)));
+  if (!ok) throw new Error('ERR_ACCESS_DENIED: fs access outside sandbox: ' + p);
+}
+const origRF = fsMod.readFileSync; fsMod.readFileSync = function(p) { guardFs(p, false); return origRF.apply(this, arguments); };
+const origWF = fsMod.writeFileSync; fsMod.writeFileSync = function(p) { guardFs(p, true); return origWF.apply(this, arguments); };
+const origAF = fsMod.appendFileSync; fsMod.appendFileSync = function(p) { guardFs(p, true); return origAF.apply(this, arguments); };
 `
       fsSync.writeFileSync(fenceFile, fenceCode, 'utf8')
 

package/lib/routes.js

@@ -303,7 +303,7 @@ ctx.effect(() => {
           }
           const effectiveCwd = recordedRun.cwd
           const promotedFiles = await promoteCandidateWorkspace(effectiveCwd, candidateIndex, {
-            runId: runId ? recordedRun.id : undefined,
+            runId: recordedRun.id,
             keepMoa: true,
             port: ctx.webServer?.port,
             timeMachineEngine: timeMachineEngine || ctx.reflect?.get?.('timeMachineEngine', false),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.46",
+  "version": "0.2.47",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",