@goodandready/dsh-moa 0.2.47 → 0.2.48

package/lib/moa-budget.js

@@ -87,11 +87,31 @@ export function estimatePanelCost(judges = [], numCandidates = 1, prices = {}, m
  * Calculates accurate synthesis prompt tokens accounting for full user prompt,
  * judge criteria, and reference candidate texts (#158).
  */
-export function calcSynthesisPromptTokens(userPrompt = '', referenceOutputs = [], judgeCriteria = '', overhead = 2600) {
-  const promptChars = (typeof userPrompt === 'string' ? userPrompt.length : 0) +
+export function calcSynthesisPromptTokens(userPrompt = '', referenceOutputs = [], judgeCriteria = '', overhead = 2600, options = {}) {
+  const opts = (typeof overhead === 'object' && overhead !== null) ? overhead : (options || {})
+  const baseOverhead = typeof overhead === 'number' ? overhead : 2600
+  let promptChars = (typeof userPrompt === 'string' ? userPrompt.length : 0) +
     (typeof judgeCriteria === 'string' ? judgeCriteria.length : 0) +
-    (Array.isArray(referenceOutputs) ? referenceOutputs.reduce((acc, r) => acc + (r.text?.length || 0), 0) : 0) +
-    overhead
+    baseOverhead
+
+  if (Array.isArray(referenceOutputs)) {
+    for (const r of referenceOutputs) {
+      promptChars += (r.text?.length || 0)
+      if (r.testResult) {
+        promptChars += 150 + (r.testResult.output?.length || 0)
+      }
+      if (r.files && r.files.length > 0) {
+        promptChars += 50 + r.files.reduce((acc, f) => acc + (f.relativePath?.length || 0), 0)
+      }
+    }
+  }
+  if (opts.priorTurnBaseline) promptChars += opts.priorTurnBaseline.length + 50
+  if (opts.consensusReport) {
+    const crText = typeof opts.consensusReport === 'string' ? opts.consensusReport : JSON.stringify(opts.consensusReport)
+    promptChars += crText.length + 50
+  }
+  if (opts.compositeMergeDirective) promptChars += opts.compositeMergeDirective.length + 50
+
   return Math.max(50, Math.ceil(promptChars / 4))
 }
 

package/lib/moa-runner.js

@@ -401,7 +401,15 @@ export async function runMoAPipeline({
     : null
 
   // 8. Synthesis phase via primary judge or fallback chain
-  const synthPromptTokens = calcSynthesisPromptTokens(userPrompt, successfulRefs, judgeCriteria)
+  const synthesisPrompt = buildSynthesisPrompt(userPrompt, referenceOutputs, judgeCriteria, {
+    curatorSynthesis: isCuratorSynthesis,
+    blindEvaluation: isBlindEvaluation,
+    priorTurnBaseline,
+    compositeMergeDirective,
+    consensusReport: multiJudgeResult?.consensusReport,
+  })
+  const synthPromptTokens = Math.max(50, Math.ceil(synthesisPrompt.length / 4))
+
   if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0 && !isFastMode) {
     const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + (multiJudgeResult?.totalCostUsd || 0)
     const downNext = estimateDownstreamCost(primaryJudge, [], successfulRefs.length, prices, maxTokens, synthPromptTokens)
@@ -411,13 +419,6 @@ export async function runMoAPipeline({
       return createBudgetAbortPayload({ reason: phaseCheck.reason, primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime, multiJudgeResult })
     }
   }
-  const synthesisPrompt = buildSynthesisPrompt(userPrompt, referenceOutputs, judgeCriteria, {
-    curatorSynthesis: isCuratorSynthesis,
-    blindEvaluation: isBlindEvaluation,
-    priorTurnBaseline,
-    compositeMergeDirective,
-    consensusReport: multiJudgeResult?.consensusReport,
-  })
   let synthesizedText = ''
   let aggUsage = { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 }
   let chosenJudge = primaryJudge

package/lib/moa-test-gate.js

@@ -43,34 +43,47 @@ export function resolveCandidateDir(baseDir, candidateIndex, options = {}) {
   }
 }
 
-const COMPUTED_SHELL_EVASION = /(?:base64\s+(?:-d|--decode|-D)|\beval\s+["\']?\$|\bxxd\s+-r|\bprintf\s+[^|\n]+\|\s*(?:ba|z|da)?sh|\bopenssl\s+enc\s+-d)/i
+export function decodeEscapedStrings(str) {
+  if (!str || typeof str !== 'string') return ''
+  let res = str.replace(/\\+/g, '\\').replace(/\\(?:([0-7]{1,3})|x([0-9a-fA-F]{2}))/g, (m, oct, hex) =>
+    oct ? String.fromCharCode(parseInt(oct, 8)) : hex ? String.fromCharCode(parseInt(hex, 16)) : m
+  )
+  return res.replace(/(?<![A-Za-z0-9+/=])(?:(?:[A-Za-z0-9+/]{4}){2,}|(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=))(?![A-Za-z0-9+/=])/g, (m) => {
+    try {
+      const dec = Buffer.from(m, 'base64').toString('utf8')
+      return /^[\x20-\x7E\r\n\t]+$/.test(dec) ? dec : m
+    } catch (err) {
+      logger.debug('[dsh-moa:testGate] base64 decode skip:', err?.message || err)
+      return m
+    }
+  })
+}
+
+const COMPUTED_SHELL_EVASION = /(?:base64\s+(?:-d|--decode|-D)[^|\n;]*\|\s*(?:ba|z|da)?sh|\beval\s+["\']?\$|\bxxd\s+-r[^|\n;]*\|\s*(?:ba|z|da)?sh|\bprintf\s+[^|\n]+\|\s*(?:ba|z|da)?sh|\bopenssl\s+enc\s+-d[^|\n;]*\|\s*(?:ba|z|da)?sh)/i
 
-const UNIX_ROOT_PREFIX = /^\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run\/(?:user|systemd|lock|credentials|secrets|udev|initramfs|mount|shm|dbus|sshd|motd)|sbin|boot|Users\/(?:[a-zA-Z0-9_\-.]+)|Applications|Library|System|Volumes|private)(?:\/|$)/
+const UNIX_ROOT_PREFIX = /^\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run\/(?:user\/\d+|systemd|lock|credentials|secrets|udev|initramfs|mount|shm|dbus|sshd|motd)|sbin|boot|Users\/(?:[a-zA-Z0-9_\-.]+)|Applications|Library|System|Volumes|private)(?:\/|$)/
 
 /**
  * Validates that an executed script or command does not reference files outside allowed roots (#161, #225).
  */
 function scanPathTokensForLeak(text, allowedRoots, executionDir) {
   if (!text || typeof text !== 'string') return null
-  const sanitized = text
-    .replace(/https?:\/\/[^\s"'<>]+/gi, '')
-    .replace(/\b(?:node|file|npm|data):[^\s"'<>]+/gi, '')
-  const matches = sanitized.match(/(?:[a-zA-Z]:[\\/][^\s"'<>]+|(?<![\w.@\/\\])\/(?:[a-zA-Z0-9_\-.]+\/)*[a-zA-Z0-9_\-.]+|(?<![\w.@\/\\])\.\.[\\/][^\s"'<>]*)/g) || []
-  for (const raw of matches) {
-    if (/^\/(usr\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\/|$)/.test(raw) && !/\.(txt|json|env|npmrc|key|ssh|md)/i.test(raw)) {
-      continue
-    }
-    const isAbs = path.isAbsolute(raw)
-    const isUp = raw.startsWith('..')
-    if (!isAbs && !isUp) continue
-    if (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(raw)) continue
-    const resolved = path.resolve(executionDir, raw)
-    const allowed = allowedRoots.some((r) => r && (resolved === r || resolved.startsWith(r + path.sep)))
-    if (!allowed) {
-      return raw
+  const checkText = (t) => {
+    const sanitized = t.replace(/https?:\/\/[^\s"'<>]+/gi, '').replace(/\b(?:node|file|npm|data):[^\s"'<>]+/gi, '')
+    const matches = sanitized.match(/(?:[a-zA-Z]:[\\/][^\s"'<>]+|(?<![\w.@\/\\])\/(?:[a-zA-Z0-9_\-.]+\/)*[a-zA-Z0-9_\-.]+|(?<![\w.@\/\\])\.\.[\\/][^\s"'<>]*)/g) || []
+    for (const raw of matches) {
+      if (/^\/(usr\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\/|$)/.test(raw) && !/\.(txt|json|env|npmrc|key|ssh|md)/i.test(raw)) continue
+      const isAbs = path.isAbsolute(raw)
+      if ((!isAbs && !raw.startsWith('..')) || (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(raw))) continue
+      const resolved = path.resolve(executionDir, raw)
+      if (!allowedRoots.some((r) => r && (resolved === r || resolved.startsWith(r + path.sep)))) return raw
     }
+    return null
   }
-  return null
+  const rawLeak = checkText(text)
+  if (rawLeak) return rawLeak
+  const decoded = decodeEscapedStrings(text)
+  return decoded !== text ? checkText(decoded) : null
 }
 
 /**
@@ -288,8 +301,17 @@ export async function runCandidateTestGate({
 const cp = require('node:child_process');
 const path = require('node:path');
 const allowed = ${JSON.stringify(allowedReads)};
-const COMPUTED_SHELL_EVASION = /(?:base64\\s+(?:-d|--decode|-D)|\\beval\\s+["\']?\\$|\\bxxd\\s+-r|\\bprintf\\s+[^|\\n]+\\|\\s*(?:ba|z|da)?sh|\\bopenssl\\s+enc\\s+-d)/i;
-const UNIX_ROOT_PREFIX = /^\\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run\\/(?:user|systemd|lock|credentials|secrets|udev|initramfs|mount|shm|dbus|sshd|motd)|sbin|boot|Users\\/(?:[a-zA-Z0-9_\\-.]+)|Applications|Library|System|Volumes|private)(?:\\/|$)/;
+function decodeEscaped(str) {
+  if (!str || typeof str !== 'string') return '';
+  const norm = str.split(/\\+/).join(String.fromCharCode(92));
+  return norm.replace(new RegExp(String.fromCharCode(92, 92) + '(?:([0-7]{1,3})|x([0-9a-fA-F]{2}))', 'g'), (m, oct, hex) => {
+    if (oct) return String.fromCharCode(parseInt(oct, 8));
+    if (hex) return String.fromCharCode(parseInt(hex, 16));
+    return m;
+  });
+}
+const COMPUTED_SHELL_EVASION = /(?:base64\\s+(?:-d|--decode|-D)[^|\\n;]*\\|\\s*(?:ba|z|da)?sh|\\beval\\s+["\']?\\$|\\bxxd\\s+-r[^|\\n;]*\\|\\s*(?:ba|z|da)?sh|\\bprintf\\s+[^|\\n]+\\|\\s*(?:ba|z|da)?sh|\\bopenssl\\s+enc\\s+-d[^|\\n;]*\\|\\s*(?:ba|z|da)?sh)/i;
+const UNIX_ROOT_PREFIX = /^\\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run\\/(?:user\\/\\d+|systemd|lock|credentials|secrets|udev|initramfs|mount|shm|dbus|sshd|motd)|sbin|boot|Users\\/(?:[a-zA-Z0-9_\\-.]+)|Applications|Library|System|Volumes|private)(?:\\/|$)/;
 function checkSinglePath(p) {
   if (!p || typeof p !== 'string') return true;
   if (/^\\/(usr\\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\\/|$)/.test(p) && !/\\.(txt|json|env|npmrc|key|ssh|md)/i.test(p)) return true;
@@ -303,10 +325,18 @@ function checkSinglePath(p) {
 function scanStringForPaths(str) {
   if (!str || typeof str !== 'string') return true;
   if (!checkSinglePath(str)) return false;
+  const dec = decodeEscaped(str);
+  if (dec !== str && !checkSinglePath(dec)) return false;
   const matches = str.match(/(?:[a-zA-Z]:[\\\\/][^\\s"'<>]+|(?<![\\w.@/\\\\])\\/(?:[a-zA-Z0-9_\\-.]+\\/)*[a-zA-Z0-9_\\-.]+|(?<![\\w.@/\\\\])\\.\\.[\\\\/][^\\s"'<>]*)/g) || [];
   for (const m of matches) {
     if (!checkSinglePath(m)) return false;
   }
+  if (dec !== str) {
+    const decMatches = dec.match(/(?:[a-zA-Z]:[\\\\/][^\\s"'<>]+|(?<![\\w.@/\\\\])\\/(?:[a-zA-Z0-9_\\-.]+\\/)*[a-zA-Z0-9_\\-.]+|(?<![\\w.@/\\\\])\\.\\.[\\\\/][^\\s"'<>]*)/g) || [];
+    for (const m of decMatches) {
+      if (!checkSinglePath(m)) return false;
+    }
+  }
   return true;
 }
 function guardArgs(cmd, args) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.47",
+  "version": "0.2.48",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",