@goodandready/dsh-moa 0.2.55 → 0.2.56

package/README.md

@@ -150,7 +150,7 @@ Inspect line-by-line differences between candidate proposals and the curator's s
 Before promoting any winning candidate files over the workspace root, `dsh-moa` invokes the local `dsh-time-machine` service to create a shadow Git checkpoint (`moa-pre-promotion: candidate-N`). If `dsh-time-machine` is absent or unreachable, file promotion is blocked (fail-closed) to protect uncheckpointed workspace files against unintended overwrites (override with `force: true` only when automated checkpoints are explicitly unneeded).
 
 ### 9. Automated Test Execution Gate
-When `test_gate_enabled: true` and `test_command` (e.g. `npm test` or `pytest`) are configured, candidate code is executed in an ephemeral sandbox overlay. The test sandbox uses process containment fences and path validation to block unauthorized host file access and computed shell evasion (base64/eval/pipes), while allowing safe HTTP route literals. The judge receives concrete test outcomes, durations, and output logs to ground decisions in objective verification.
+When `test_gate_enabled: true` and `test_command` (e.g. `npm test` or `pytest`) are configured, candidate code is executed in an ephemeral sandbox overlay under Node.js native permission model (`--permission`) and an ephemeral runtime fence (`lib/moa-sandbox.js`). Without OS-level container isolation (bubblewrap), child process execution is strictly prohibited (`--allow-child-process` is omitted) to prevent candidate scripts from stripping `NODE_OPTIONS` and escaping sandbox restrictions (#260). Package manager commands (`npm test`, `pnpm test`) are resolved directly to underlying `package.json` test scripts, while any evasion patterns (`env -u NODE_OPTIONS`, `unset NODE_OPTIONS`, computed shell evasion) are detected and fail-closed prior to execution. The judge receives concrete test outcomes, durations, and output logs to ground decisions in objective verification.
 
 ### 10. Multi-Judge Panel & Consensus Voting
 When `multi_judge_enabled: true`, candidate solutions are independently evaluated by a panel of judge models. Winner selection supports `majority`, `highest_score`, or `unanimous` consensus strategies.
@@ -335,7 +335,7 @@ npm test
 ## 🛠️ Internal Tooling & Development
 
 For local verification and package integrity validation:
-- `npm test`: runs the full test suite (288 tests)
+- `npm test`: runs the full test suite (294 tests)
 - `./deploy.sh`: local infrastructure validation script (verifies package size, identity parity in package.json/cordis.patch.yml/client.js, and tests). Excluded from the published npm package.
 
 ## 📄 License

package/README.ru.md

@@ -150,7 +150,7 @@ graph TD
 Перед промоушном файлов победителя в корень рабочей области `dsh-moa` автоматически обращается к сервису `dsh-time-machine` для создания снимка (`moa-pre-promotion: candidate-N`). Если плагин недоступен или создание снимка завершилось ошибкой, перезапись файлов блокируется во избежание потери несохранённых данных (переопределяется параметром `force: true`, только если создание снимков намеренно отключено).
 
 ### 9. Автоматический шлюз выполнения тестов (Automated Test Execution Gate)
-При включении `test_gate_enabled: true` и указании тестовой команды (`test_command`, например `npm test` или `pytest`) каждый кандидат запускается в изолированном оверлейном окружении с защитой от выхода за пределы песочницы (блокировка вычисляемых shell-команд base64/eval/pipes при сохранении безопасных строковых REST-маршрутов). Судья получает объективный вердикт с кодами возврата, временем исполнения и логами тестов до вынесения итогового решения.
+При включении `test_gate_enabled: true` и указании тестовой команды (`test_command`, например `npm test` или `pytest`) каждый кандидат запускается в изолированном оверлейном окружении под нативной моделью прав Node.js (`--permission`) и рантайм-фенсом (`lib/moa-sandbox.js`). При отсутствии изоляции уровня ОС (bubblewrap) создание дочерних процессов строго запрещено (флаг `--allow-child-process` исключён), что предотвращает обход песочницы через сброс `NODE_OPTIONS` (#260). Команды пакетных менеджеров (`npm test`, `pnpm test`) разрешаются напрямую в скрипты `package.json`, а любые векторы уклонения (`env -u NODE_OPTIONS`, `unset NODE_OPTIONS`, base64/eval/pipes) блокируются до запуска. Судья получает объективный вердикт с кодами возврата, временем исполнения и логами тестов до вынесения итогового решения.
 
 ### 10. Коллегия судей и консенсусное голосование (Multi-Judge Panel)
 При активации опции `multi_judge_enabled` решения кандидатов оценивает независимая панель судейских моделей с поддержкой стратегий голосования: `majority` (большинство), `highest_score` (наивысший средний балл) или `unanimous` (единогласный консенсус).

package/README.zh.md

@@ -150,6 +150,9 @@ graph TD
 ### 8. 提升前 Git 快照检查点 (`dsh-time-machine`)
 在将胜出候选者的文件提升并覆盖至项目根目录前，`dsh-moa` 自动调用本地 `dsh-time-machine` 建立影子 Git 检查点 (`moa-pre-promotion: candidate-N`)。如 `dsh-time-machine` 未安装或无法访问，文件提升将被阻断以防止未备份的项目文件被意外覆盖（仅在明确不需要检查点时可通过 `force: true` 覆盖）。
 
+### 9. 自动化测试执行网关 (Automated Test Execution Gate)
+当启用 `test_gate_enabled: true` 并配置 `test_command`（如 `npm test` 或 `pytest`）时，候选代码将在临时沙箱覆盖层中执行。沙箱基于 Node.js 原生权限模型（`--permission`）与运行时防护栏（`lib/moa-sandbox.js`）。在无操作系统级容器隔离（bubblewrap）时，严格禁用子进程创建（省略 `--allow-child-process`），杜绝候选代码通过剥离 `NODE_OPTIONS` 逃逸沙箱 (#260)。包管理器命令（`npm test`）直接映射到底层脚本，并在执行前严密拦截任何规避意图（`env -u NODE_OPTIONS`、`unset NODE_OPTIONS` 等）。裁判在最终决策前将获取客观的测试结果、耗时与输出日志。
+
 ### 18. 平滑降级与本地容灾恢复 (Local Fallback Resilience)
 当 `local_fallback_enabled: true` 时，因网络中断、超时或速率限制（429/500）而失败的候选模型会自动使用配置的本地模型（Ollama / MiniPC）恢复。每个后备模型都拥有独立的超时执行配额与关联主 turn signal 的隔离取消控制器，防止云端超时耗尽本地恢复时间。同时严格检测终止错误与流中断，确保安全容灾且杜绝已取消 turn 的延迟文件提升。
 

package/lib/moa-sandbox.js

@@ -0,0 +1,287 @@
+/**
+ * DeepSeek Harness Mixture of Agents (MoA) — Test Gate OS & Node Sandbox (#260)
+ *
+ * Implements OS-level isolation probing, permission model flags,
+ * fence module generation, environment sanitization, and evasion inspection.
+ */
+
+import cp from 'node:child_process'
+import path from 'node:path'
+import fsSync from 'node:fs'
+import { logger } from './logger.js'
+
+export const COMPUTED_SHELL_EVASION = /(?:base64\s+(?:-d|--decode|-D)[^|\n;]*\|\s*(?:ba|z|da)?sh|\beval\s+["']?\$|\bxxd\s+-r[^|\n;]*\|\s*(?:ba|z|da)?sh|\bprintf\s+[^|\n]+\|\s*(?:ba|z|da)?sh|\bopenssl\s+enc\s+-d[^|\n;]*\|\s*(?:ba|z|da)?sh|\bprintf\s+(?:%s|["']%s["'])\s+.*["'](?:\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\$\(\s*(?:printf|echo)\s+.*["'](?:\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\x60\s*(?:printf|echo)\s+.*["'](?:\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\b(?:cat|head|tail|source|\.|touch|rm|cp|mv)\s+["']?\$[A-Za-z_]|>\s*["']?\$[A-Za-z_]|>>\s*["']?\$[A-Za-z_])/i
+
+export const NODE_OPTIONS_EVASION = /(?:\benv\b[^|;\n]*(?:-[^\s]*u\s*NODE_OPTIONS|--unset=NODE_OPTIONS)|\bunset\s+NODE_OPTIONS|\bexport\s+NODE_OPTIONS\s*=|\bNODE_OPTIONS\s*=)/i
+
+export const DANGEROUS_BINARIES = /\b(?:sudo|su|bwrap|chroot|systemd-run)\b/i
+
+export const UNIX_ROOT_PREFIX = /^\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run\/(?:user\/\d+|systemd|lock|credentials|secrets|udev|initramfs|mount|shm|dbus|sshd|motd)|sbin|boot|Users\/(?:[a-zA-Z0-9_\-.]+)|Applications|Library|System|Volumes|private)(?:\/|$)/
+
+export const SAFE_SYS_DIRS = /^\/(?:usr\/(?:bin|lib|include)|bin|lib|lib64|etc|dev)(?:\/|$)/
+
+export const SENSITIVE_EXTS = /\.(?:txt|json|env|npmrc|key|ssh|md)/i
+
+export const PATH_TOKEN_REGEX = /(?:[a-zA-Z]:[\\/][^\s"'<>]+|(?<![\w.@/\\])\/(?:[a-zA-Z0-9_\-.]+\/)*[a-zA-Z0-9_\-.]+|(?<![\w.@/\\])\.\.[\\/][^\s"'<>]*)/g
+
+export const OCTAL_HEX_ESCAPE = /\\(?:([0-7]{1,3})|x([0-9a-fA-F]{2}))/g
+
+let cachedOsSandbox = null
+
+/**
+ * Checks whether OS-level unprivileged sandbox (bubblewrap) is fully operational (#260).
+ */
+export function isOsSandboxAvailable() {
+  if (cachedOsSandbox !== null) return cachedOsSandbox
+  if (process.platform !== 'linux') {
+    cachedOsSandbox = false
+    return false
+  }
+  try {
+    const probe = cp.spawnSync(
+      'bwrap',
+      ['--ro-bind', '/usr', '/usr', '--proc', '/proc', '--dev', '/dev', '--', 'true'],
+      { timeout: 2000, stdio: 'ignore' }
+    )
+    cachedOsSandbox = probe.status === 0
+  } catch (probeErr) {
+    logger.debug('[dsh-moa:sandbox] OS sandbox probe error:', probeErr?.message || probeErr)
+    cachedOsSandbox = false
+  }
+  return cachedOsSandbox
+}
+
+/**
+ * Resolves package manager runner commands (e.g. `npm test`) to direct script invocations
+ * to allow execution under Node permission model without requiring --allow-child-process (#260).
+ */
+export function resolveTestCommand({ testCommand, executionDir }) {
+  if (!testCommand || typeof testCommand !== 'string') return ''
+  const trimmed = testCommand.trim()
+  const npmMatch = trimmed.match(/^(?:npm\s+(?:run\s+)?test|npm\s+t|pnpm\s+(?:run\s+)?test|pnpm\s+t|yarn\s+test)(?:\s+--?\s*(.*))?$/i)
+  if (npmMatch && executionDir) {
+    const candPkgFile = path.join(executionDir, 'package.json')
+    if (fsSync.existsSync(candPkgFile)) {
+      try {
+        const pkgObj = JSON.parse(fsSync.readFileSync(candPkgFile, 'utf8'))
+        const scriptCmd = pkgObj.scripts?.test
+        if (scriptCmd && typeof scriptCmd === 'string') {
+          const extraArgs = npmMatch[1] ? ` ${npmMatch[1]}` : ''
+          return scriptCmd.trim() + extraArgs
+        }
+      } catch (pkgErr) {
+        logger.debug('[dsh-moa:sandbox] package.json parse error in resolveTestCommand:', pkgErr?.message || pkgErr)
+      }
+    }
+  }
+  return trimmed
+}
+
+/**
+ * Inspects a command or script string for obfuscation or security environment evasion (#161, #260).
+ */
+export function isSandboxEvasion(text) {
+  if (!text || typeof text !== 'string') return null
+  if (COMPUTED_SHELL_EVASION.test(text)) {
+    return 'obfuscated or computed command execution'
+  }
+  if (NODE_OPTIONS_EVASION.test(text)) {
+    return 'attempts to bypass sandbox or strip security environment (NODE_OPTIONS)'
+  }
+  if (DANGEROUS_BINARIES.test(text)) {
+    return 'unauthorized privileged or sandbox-escape binary execution'
+  }
+  return null
+}
+
+/**
+ * Decodes octal and hex escape sequences in strings.
+ */
+export function decodeEscapedStrings(str) {
+  if (!str || typeof str !== 'string') return ''
+  const normalized = str.split(/\\+/).join('\\')
+  return normalized.replace(OCTAL_HEX_ESCAPE, (m, oct, hex) => {
+    if (oct) return String.fromCharCode(parseInt(oct, 8))
+    if (hex) return String.fromCharCode(parseInt(hex, 16))
+    return m
+  })
+}
+
+/**
+ * Validates that an executed script or command does not reference files outside allowed roots (#161, #225, #260).
+ */
+export function scanPathTokensForLeak(text, allowedRoots, executionDir) {
+  if (!text || typeof text !== 'string') return null
+  const checkText = (t) => {
+    const sanitized = t.replace(/https?:\/\/[^\s"'<>]+/gi, '').replace(/\b(?:node|file|npm|data):[^\s"'<>]+/gi, '')
+    const matches = sanitized.match(PATH_TOKEN_REGEX) || []
+    for (const raw of matches) {
+      if (SAFE_SYS_DIRS.test(raw) && !SENSITIVE_EXTS.test(raw)) continue
+      const isAbs = path.isAbsolute(raw)
+      if ((!isAbs && !raw.startsWith('..')) || (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(raw))) continue
+      const resolved = path.resolve(executionDir, raw)
+      if (!allowedRoots.some((r) => r && (resolved === r || resolved.startsWith(r + path.sep)))) return raw
+    }
+    return null
+  }
+  const rawLeak = checkText(text)
+  if (rawLeak) return rawLeak
+  const segmented = text.match(/\bprintf\s+(?:%s|['"]%s['"])\s+((?:['"][^'"]*['"]\s*)+)/i)
+  if (segmented) {
+    const assembled = (segmented[1].match(/['"]([^'"]*)['"]/g) || []).map((s) => s.slice(1, -1)).join('')
+    const assembledLeak = checkText(assembled)
+    if (assembledLeak) return assembledLeak
+  }
+  const decoded = decodeEscapedStrings(text)
+  return decoded !== text ? checkText(decoded) : null
+}
+
+/**
+ * Sanitizes process environment for untrusted candidate tests (#244, #260).
+ */
+export function getScrubbedEnv(overrides = {}) {
+  const safeVars = new Set([
+    'PATH', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TMPDIR', 'TEMP', 'TMP',
+    'USER', 'LOGNAME', 'HOME', 'SHELL', 'TERM', 'NODE_ENV', 'SYSTEMROOT',
+    'WINDIR', 'COMSPEC', 'PATHEXT',
+  ])
+  const scrubbed = {}
+  for (const [key, val] of Object.entries(process.env)) {
+    if (!val || key.startsWith('MOA_') || key.startsWith('DSH_') || key.startsWith('SSH_')) continue
+    if (/(API_KEY|TOKEN|SECRET|PASSWORD|PASSWD|AUTH|CREDENTIAL|PRIVATE|KEY|ACCESS)/i.test(key)) {
+      continue
+    }
+    if (safeVars.has(key) || key.startsWith('LC_')) {
+      scrubbed[key] = val
+    }
+  }
+  return { ...scrubbed, ...overrides }
+}
+
+/**
+ * Builds Node.js permission model CLI options (#260).
+ *
+ * CRITICAL SECURITY CONTRACT:
+ * When OS-level container isolation is NOT active, --allow-child-process MUST NOT be used,
+ * because child processes can strip NODE_OPTIONS and bypass the permission model.
+ */
+export function buildPermOpts({ allowedReads, executionDir, effectiveHome, fenceFile, hasOsSandbox = false }) {
+  const readFlags = allowedReads.map((p) => `--allow-fs-read=${p}`).join(' ')
+  const writeFlags = `--allow-fs-write=${executionDir} --allow-fs-write=${effectiveHome}`
+  const childFlag = hasOsSandbox ? ' --allow-child-process' : ''
+  return `--permission ${readFlags} ${writeFlags}${childFlag} --require ${fenceFile}`
+}
+
+/**
+ * Generates the source code for the ephemeral runtime fence module (#161, #260).
+ */
+export function generateFenceCode({ allowedReads, hasOsSandbox = false }) {
+  const allowedJson = JSON.stringify(allowedReads)
+  const evasionPattern = JSON.stringify(COMPUTED_SHELL_EVASION.source)
+  const nodeOptsPattern = JSON.stringify(NODE_OPTIONS_EVASION.source)
+  const unixRootPattern = JSON.stringify(UNIX_ROOT_PREFIX.source)
+  const sysDirsPattern = JSON.stringify(SAFE_SYS_DIRS.source)
+  const sensExtsPattern = JSON.stringify(SENSITIVE_EXTS.source)
+  const pathTokenPattern = JSON.stringify(PATH_TOKEN_REGEX.source)
+  const octalHexPattern = JSON.stringify(OCTAL_HEX_ESCAPE.source)
+
+  return [
+    "const cp = require('node:child_process');",
+    "const path = require('node:path');",
+    `const allowed = ${allowedJson};`,
+    `const hasOsSandbox = ${hasOsSandbox ? 'true' : 'false'};`,
+    "",
+    `const COMPUTED_SHELL_EVASION = new RegExp(${evasionPattern}, 'i');`,
+    `const NODE_OPTIONS_EVASION = new RegExp(${nodeOptsPattern}, 'i');`,
+    `const UNIX_ROOT_PREFIX = new RegExp(${unixRootPattern});`,
+    `const SAFE_SYS_DIRS = new RegExp(${sysDirsPattern});`,
+    `const SENSITIVE_EXTS = new RegExp(${sensExtsPattern}, 'i');`,
+    `const PATH_TOKEN_REGEX = new RegExp(${pathTokenPattern}, 'g');`,
+    `const OCTAL_HEX_ESCAPE = new RegExp(${octalHexPattern}, 'g');`,
+    "",
+    "function decodeEscaped(str) {",
+    "  if (!str || typeof str !== 'string') return '';",
+    "  const norm = str.replace(/\\+/g, '\\\\');",
+    "  return norm.replace(OCTAL_HEX_ESCAPE, (m, oct, hex) => {",
+    "    if (oct) return String.fromCharCode(parseInt(oct, 8));",
+    "    if (hex) return String.fromCharCode(parseInt(hex, 16));",
+    "    return m;",
+    "  });",
+    "}",
+    "",
+    "function checkSinglePath(p) {",
+    "  if (!p || typeof p !== 'string') return true;",
+    "  if (SAFE_SYS_DIRS.test(p) && !SENSITIVE_EXTS.test(p)) return true;",
+    "  const isAbs = path.isAbsolute(p);",
+    "  const isUp = p.startsWith('..');",
+    "  if (!isAbs && !isUp) return true;",
+    "  if (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(p)) return true;",
+    "  const res = path.resolve(process.cwd(), p);",
+    "  return allowed.some(root => root && (res === root || res.startsWith(root + path.sep)));",
+    "}",
+    "",
+    "function scanStringForPaths(str) {",
+    "  if (!str || typeof str !== 'string') return true;",
+    "  if (!checkSinglePath(str)) return false;",
+    "  const dec = decodeEscaped(str);",
+    "  if (dec !== str && !checkSinglePath(dec)) return false;",
+    "  const matches = str.match(PATH_TOKEN_REGEX) || [];",
+    "  for (const m of matches) {",
+    "    if (!checkSinglePath(m)) return false;",
+    "  }",
+    "  if (dec !== str) {",
+    "    const decMatches = dec.match(PATH_TOKEN_REGEX) || [];",
+    "    for (const m of decMatches) {",
+    "      if (!checkSinglePath(m)) return false;",
+    "    }",
+    "  }",
+    "  return true;",
+    "}",
+    "",
+    "function guardChildCall(methodName, cmd, args) {",
+    "  if (!hasOsSandbox) {",
+    "    throw new Error('ERR_ACCESS_DENIED: child process execution restricted without OS-level sandbox: ' + methodName);",
+    "  }",
+    "  const full = [cmd, ...(Array.isArray(args) ? args : [])].join(' ');",
+    "  if (COMPUTED_SHELL_EVASION.test(full)) {",
+    "    throw new Error('ERR_ACCESS_DENIED: child process computed execution pattern blocked: ' + full);",
+    "  }",
+    "  if (NODE_OPTIONS_EVASION.test(full)) {",
+    "    throw new Error('ERR_ACCESS_DENIED: child process attempts to strip security environment: ' + full);",
+    "  }",
+    "  if (cmd && !scanStringForPaths(String(cmd))) {",
+    "    throw new Error('ERR_ACCESS_DENIED: child process command outside sandbox: ' + cmd);",
+    "  }",
+    "  if (Array.isArray(args)) {",
+    "    for (const a of args) {",
+    "      if (a && !scanStringForPaths(String(a))) {",
+    "        throw new Error('ERR_ACCESS_DENIED: child process argument outside sandbox: ' + a);",
+    "      }",
+    "    }",
+    "  }",
+    "}",
+    "",
+    "const origSpawn = cp.spawn; cp.spawn = function(cmd, args, opts) { guardChildCall('spawn', cmd, args); return origSpawn.apply(this, arguments); };",
+    "const origSpawnSync = cp.spawnSync; cp.spawnSync = function(cmd, args, opts) { guardChildCall('spawnSync', cmd, args); return origSpawnSync.apply(this, arguments); };",
+    "const origExecFile = cp.execFile; cp.execFile = function(file, args, opts, cb) { guardChildCall('execFile', file, args); return origExecFile.apply(this, arguments); };",
+    "const origExecFileSync = cp.execFileSync; cp.execFileSync = function(file, args, opts) { guardChildCall('execFileSync', file, args); return origExecFileSync.apply(this, arguments); };",
+    "const origExec = cp.exec; cp.exec = function(cmd, opts, cb) { guardChildCall('exec', cmd, [cmd]); return origExec.apply(this, arguments); };",
+    "const origExecSync = cp.execSync; cp.execSync = function(cmd, opts) { guardChildCall('execSync', cmd, [cmd]); return origExecSync.apply(this, arguments); };",
+    "const origFork = cp.fork; cp.fork = function(modulePath, args, opts) { guardChildCall('fork', modulePath, args); return origFork.apply(this, arguments); };",
+    "",
+    "const fsMod = require('node:fs');",
+    "function guardFs(p, isWrite) {",
+    "  if (!p || typeof p !== 'string') return;",
+    "  const isAbs = path.isAbsolute(p);",
+    "  const isUp = p.startsWith('..');",
+    "  if (!isAbs && !isUp) return;",
+    "  const resolved = path.resolve(process.cwd(), p);",
+    "  const checkRoots = isWrite ? [process.cwd(), process.env.HOME].filter(Boolean) : allowed;",
+    "  const ok = checkRoots.some(r => r && (resolved === r || resolved.startsWith(r + path.sep)));",
+    "  if (!ok) throw new Error('ERR_ACCESS_DENIED: fs access outside sandbox: ' + p);",
+    "}",
+    "const origRF = fsMod.readFileSync; fsMod.readFileSync = function(p) { guardFs(p, false); return origRF.apply(this, arguments); };",
+    "const origWF = fsMod.writeFileSync; fsMod.writeFileSync = function(p) { guardFs(p, true); return origWF.apply(this, arguments); };",
+    "const origAF = fsMod.appendFileSync; fsMod.appendFileSync = function(p) { guardFs(p, true); return origAF.apply(this, arguments); };",
+  ].join('\n')
+}

package/lib/moa-test-gate.js

@@ -1,3 +1,11 @@
+/**
+ * DeepSeek Harness Mixture of Agents (MoA) — Test Execution Gate (#161, #242, #260)
+ *
+ * Runs candidate code through verification tests in an isolated sandbox.
+ * Enforces Node.js permission model containment, fence interception,
+ * and rejection of child process evasion without OS-level isolation.
+ */
+
 import os from 'node:os'
 import fs from 'node:fs/promises'
 import fsSync from 'node:fs'
@@ -6,31 +14,20 @@ import { spawn } from 'node:child_process'
 import { resolveCandidateFolder } from './file-workspace.js'
 import { bestEffort } from './best-effort.js'
 import { logger } from './logger.js'
+import {
+  isSandboxEvasion,
+  isOsSandboxAvailable,
+  resolveTestCommand,
+  scanPathTokensForLeak,
+  getScrubbedEnv,
+  buildPermOpts,
+  generateFenceCode,
+} from './moa-sandbox.js'
+
+export { getScrubbedEnv, scanPathTokensForLeak }
 
 const MAX_CAPTURE_BYTES = 256 * 1024
 
-/**
- * Returns a sanitized environment stripping sensitive tokens and secrets (#161).
- */
-export function getScrubbedEnv(overrides = {}) {
-  const safeVars = new Set([
-    'PATH', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TMPDIR', 'TEMP', 'TMP',
-    'USER', 'LOGNAME', 'HOME', 'SHELL', 'TERM', 'NODE_ENV', 'SYSTEMROOT',
-    'WINDIR', 'COMSPEC', 'PATHEXT',
-  ])
-  const scrubbed = {}
-  for (const [key, val] of Object.entries(process.env)) {
-    if (!val || key.startsWith('MOA_')) continue
-    if (/(API_KEY|TOKEN|SECRET|PASSWORD|PASSWD|AUTH|CREDENTIAL|PRIVATE|KEY|ACCESS)/i.test(key)) {
-      continue
-    }
-    if (safeVars.has(key) || key.startsWith('LC_')) {
-      scrubbed[key] = val
-    }
-  }
-  return { ...scrubbed, ...overrides }
-}
-
 /**
  * Resolves the directory for candidate sandbox.
  */
@@ -43,46 +40,6 @@ export function resolveCandidateDir(baseDir, candidateIndex, options = {}) {
   }
 }
 
-export function decodeEscapedStrings(str) {
-  if (!str || typeof str !== 'string') return ''
-  return str.replace(/\\+/g, '\\').replace(/\\(?:([0-7]{1,3})|x([0-9a-fA-F]{2}))/g, (m, oct, hex) =>
-    oct ? String.fromCharCode(parseInt(oct, 8)) : hex ? String.fromCharCode(parseInt(hex, 16)) : m
-  )
-}
-
-const COMPUTED_SHELL_EVASION = /(?:base64\s+(?:-d|--decode|-D)[^|\n;]*\|\s*(?:ba|z|da)?sh|\beval\s+["']?\$|\bxxd\s+-r[^|\n;]*\|\s*(?:ba|z|da)?sh|\bprintf\s+[^|\n]+\|\s*(?:ba|z|da)?sh|\bopenssl\s+enc\s+-d[^|\n;]*\|\s*(?:ba|z|da)?sh|\bprintf\s+(?:%s|["']%s["'])\s+.*["'](?:\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\$\(\s*(?:printf|echo)\s+.*["'](?:\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\x60\s*(?:printf|echo)\s+.*["'](?:\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\b(?:cat|head|tail|source|\.|touch|rm|cp|mv)\s+["']?\$[A-Za-z_]|>\s*["']?\$[A-Za-z_]|>>\s*["']?\$[A-Za-z_])/i
-
-const UNIX_ROOT_PREFIX = /^\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run\/(?:user\/\d+|systemd|lock|credentials|secrets|udev|initramfs|mount|shm|dbus|sshd|motd)|sbin|boot|Users\/(?:[a-zA-Z0-9_\-.]+)|Applications|Library|System|Volumes|private)(?:\/|$)/
-
-/**
- * Validates that an executed script or command does not reference files outside allowed roots (#161, #225).
- */
-function scanPathTokensForLeak(text, allowedRoots, executionDir) {
-  if (!text || typeof text !== 'string') return null
-  const checkText = (t) => {
-    const sanitized = t.replace(/https?:\/\/[^\s"'<>]+/gi, '').replace(/\b(?:node|file|npm|data):[^\s"'<>]+/gi, '')
-    const matches = sanitized.match(/(?:[a-zA-Z]:[\\/][^\s"'<>]+|(?<![\w.@\/\\])\/(?:[a-zA-Z0-9_\-.]+\/)*[a-zA-Z0-9_\-.]+|(?<![\w.@\/\\])\.\.[\\/][^\s"'<>]*)/g) || []
-    for (const raw of matches) {
-      if (/^\/(usr\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\/|$)/.test(raw) && !/\.(txt|json|env|npmrc|key|ssh|md)/i.test(raw)) continue
-      const isAbs = path.isAbsolute(raw)
-      if ((!isAbs && !raw.startsWith('..')) || (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(raw))) continue
-      const resolved = path.resolve(executionDir, raw)
-      if (!allowedRoots.some((r) => r && (resolved === r || resolved.startsWith(r + path.sep)))) return raw
-    }
-    return null
-  }
-  const rawLeak = checkText(text)
-  if (rawLeak) return rawLeak
-  const segmented = text.match(/\bprintf\s+(?:%s|['"]%s['"])\s+((?:['"][^'"]*['"]\s*)+)/i)
-  if (segmented) {
-    const assembled = (segmented[1].match(/['"]([^'"]*)['"]/g) || []).map((s) => s.slice(1, -1)).join('')
-    const assembledLeak = checkText(assembled)
-    if (assembledLeak) return assembledLeak
-  }
-  const decoded = decodeEscapedStrings(text)
-  return decoded !== text ? checkText(decoded) : null
-}
-
 /**
  * Executes a test command in a candidate sandbox or ephemeral test staging directory.
  */
@@ -142,10 +99,10 @@ export async function runCandidateTestGate({
       return res
     }
 
-    let resolvedCmd = trimmedCmd
-    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{candidateDir}', candidateDir)
-    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{baseDir}', cwd)
-    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{stageDir}', executionDir)
+    let resolvedCmd = resolveTestCommand({ testCommand: trimmedCmd, executionDir })
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '<CANDIDATE_DIR>', executionDir)
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{candidateDir}', executionDir)
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '$CANDIDATE_DIR', executionDir)
 
     let exitCode = 0
     let stdout = ''
@@ -163,7 +120,9 @@ export async function runCandidateTestGate({
       stderr = customRes?.stderr || ''
     } else {
       const allowedRoots = [executionDir, cwd, ...(candidateDir && candidateDir !== executionDir ? [candidateDir] : [])]
-      if (COMPUTED_SHELL_EVASION.test(resolvedCmd)) {
+      
+      const cmdEvasion = isSandboxEvasion(resolvedCmd)
+      if (cmdEvasion) {
         const durationMs = Date.now() - startTime
         return {
           candidateIndex,
@@ -171,7 +130,7 @@ export async function runCandidateTestGate({
           exitCode: 1,
           durationMs,
           command: resolvedCmd,
-          output: 'Access denied: test command contains obfuscated or computed command execution',
+          output: `Access denied: test command contains ${cmdEvasion}`,
           summary: `FAIL (code 1, ${durationMs}ms)`,
         }
       }
@@ -201,7 +160,7 @@ export async function runCandidateTestGate({
         }
       }
 
-      // 2. Scan script files referenced by command or present in candidate workspace (#161)
+      // 2. Scan script files referenced by command or present in candidate workspace (#161, #260)
       const candFiles = fsSync.existsSync(executionDir) ? fsSync.readdirSync(executionDir, { recursive: true }) : []
       const scriptTokens = new Set([
         ...cmdTokens.map((t) => t.replace(/^["']|["']$/g, '')),
@@ -213,7 +172,8 @@ export async function runCandidateTestGate({
         if (fsSync.existsSync(scriptPath) && !fsSync.statSync(scriptPath).isDirectory()) {
           try {
             const scriptText = fsSync.readFileSync(scriptPath, 'utf8')
-            if (COMPUTED_SHELL_EVASION.test(scriptText)) {
+            const scriptEvasion = isSandboxEvasion(scriptText)
+            if (scriptEvasion) {
               const durationMs = Date.now() - startTime
               return {
                 candidateIndex,
@@ -221,7 +181,7 @@ export async function runCandidateTestGate({
                 exitCode: 1,
                 durationMs,
                 command: resolvedCmd,
-                output: 'Access denied: test script contains obfuscated or computed command execution',
+                output: `Access denied: test script contains ${scriptEvasion}`,
                 summary: `FAIL (code 1, ${durationMs}ms)`,
               }
             }
@@ -244,13 +204,14 @@ export async function runCandidateTestGate({
         }
       }
 
-      // 3. Scan package.json scripts if package.json exists in executionDir (#161, #206)
+      // 3. Scan package.json scripts if package.json exists in executionDir (#161, #206, #260)
       const candPkgFile = path.join(executionDir, 'package.json')
       if (fsSync.existsSync(candPkgFile)) {
         try {
           const pkgObj = JSON.parse(fsSync.readFileSync(candPkgFile, 'utf8'))
           const scriptsContent = Object.values(pkgObj.scripts || {}).join('\n')
-          if (COMPUTED_SHELL_EVASION.test(scriptsContent)) {
+          const pkgEvasion = isSandboxEvasion(scriptsContent)
+          if (pkgEvasion) {
             const durationMs = Date.now() - startTime
             return {
               candidateIndex,
@@ -258,7 +219,7 @@ export async function runCandidateTestGate({
               exitCode: 1,
               durationMs,
               command: resolvedCmd,
-              output: 'Access denied: package.json test script contains obfuscated or computed command execution',
+              output: `Access denied: package.json test script contains ${pkgEvasion}`,
               summary: `FAIL (code 1, ${durationMs}ms)`,
             }
           }
@@ -304,90 +265,20 @@ export async function runCandidateTestGate({
           : ['/usr', '/lib', '/lib64', '/etc']),
       ].filter(Boolean)
 
-      // Create security fence module for child process containment (#161, #206)
+      // Create security fence module for child process containment (#161, #206, #260)
+      const hasOsSandbox = isOsSandboxAvailable()
       fenceFile = path.join(executionDir, `.moa-fence-${Date.now()}.cjs`)
-      const fenceCode = `
-const cp = require('node:child_process');
-const path = require('node:path');
-const allowed = ${JSON.stringify(allowedReads)};
-function decodeEscaped(str) {
-  if (!str || typeof str !== 'string') return '';
-  const norm = str.split(/\\+/).join(String.fromCharCode(92));
-  return norm.replace(new RegExp(String.fromCharCode(92, 92) + '(?:([0-7]{1,3})|x([0-9a-fA-F]{2}))', 'g'), (m, oct, hex) => {
-    if (oct) return String.fromCharCode(parseInt(oct, 8));
-    if (hex) return String.fromCharCode(parseInt(hex, 16));
-    return m;
-  });
-}
-const COMPUTED_SHELL_EVASION = /(?:base64\\s+(?:-d|--decode|-D)[^|\\n;]*\\|\\s*(?:ba|z|da)?sh|\\beval\\s+["']?\\$|\\bxxd\\s+-r[^|\\n;]*\\|\\s*(?:ba|z|da)?sh|\\bprintf\\s+[^|\\n]+\\|\\s*(?:ba|z|da)?sh|\\bopenssl\\s+enc\\s+-d[^|\\n;]*\\|\\s*(?:ba|z|da)?sh|\\bprintf\\s+(?:%s|["']%s["'])\\s+.*["'](?:\\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\\$\\(\\s*(?:printf|echo)\\s+.*["'](?:\\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\\x60\\s*(?:printf|echo)\\s+.*["'](?:\\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\\b(?:cat|head|tail|source|\\.|touch|rm|cp|mv)\\s+["']?\\$[A-Za-z_]|>\\s*["']?\\$[A-Za-z_]|>>\\s*["']?\\$[A-Za-z_])/i;
-const UNIX_ROOT_PREFIX = /^\\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run\\/(?:user\\/\\d+|systemd|lock|credentials|secrets|udev|initramfs|mount|shm|dbus|sshd|motd)|sbin|boot|Users\\/(?:[a-zA-Z0-9_\\-.]+)|Applications|Library|System|Volumes|private)(?:\\/|$)/;
-function checkSinglePath(p) {
-  if (!p || typeof p !== 'string') return true;
-  if (/^\\/(usr\\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\\/|$)/.test(p) && !/\\.(txt|json|env|npmrc|key|ssh|md)/i.test(p)) return true;
-  const isAbs = path.isAbsolute(p);
-  const isUp = p.startsWith('..');
-  if (!isAbs && !isUp) return true;
-  if (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(p)) return true;
-  const res = path.resolve(process.cwd(), p);
-  return allowed.some(root => root && (res === root || res.startsWith(root + path.sep)));
-}
-function scanStringForPaths(str) {
-  if (!str || typeof str !== 'string') return true;
-  if (!checkSinglePath(str)) return false;
-  const dec = decodeEscaped(str);
-  if (dec !== str && !checkSinglePath(dec)) return false;
-  const matches = str.match(/(?:[a-zA-Z]:[\\\\/][^\\s"'<>]+|(?<![\\w.@/\\\\])\\/(?:[a-zA-Z0-9_\\-.]+\\/)*[a-zA-Z0-9_\\-.]+|(?<![\\w.@/\\\\])\\.\\.[\\\\/][^\\s"'<>]*)/g) || [];
-  for (const m of matches) {
-    if (!checkSinglePath(m)) return false;
-  }
-  if (dec !== str) {
-    const decMatches = dec.match(/(?:[a-zA-Z]:[\\\\/][^\\s"'<>]+|(?<![\\w.@/\\\\])\\/(?:[a-zA-Z0-9_\\-.]+\\/)*[a-zA-Z0-9_\\-.]+|(?<![\\w.@/\\\\])\\.\\.[\\\\/][^\\s"'<>]*)/g) || [];
-    for (const m of decMatches) {
-      if (!checkSinglePath(m)) return false;
-    }
-  }
-  return true;
-}
-function guardArgs(cmd, args) {
-  const full = [cmd, ...(Array.isArray(args) ? args : [])].join(' ');
-  if (COMPUTED_SHELL_EVASION.test(full)) {
-    throw new Error('ERR_ACCESS_DENIED: child process computed execution pattern blocked: ' + full);
-  }
-  if (cmd && !scanStringForPaths(String(cmd))) {
-    throw new Error('ERR_ACCESS_DENIED: child process command outside sandbox: ' + cmd);
-  }
-  if (Array.isArray(args)) {
-    for (const a of args) {
-      if (a && !scanStringForPaths(String(a))) {
-        throw new Error('ERR_ACCESS_DENIED: child process argument outside sandbox: ' + a);
-      }
-    }
-  }
-}
-const origSpawn = cp.spawn; cp.spawn = function(cmd, args, opts) { guardArgs(cmd, args); return origSpawn.apply(this, arguments); };
-const origSpawnSync = cp.spawnSync; cp.spawnSync = function(cmd, args, opts) { guardArgs(cmd, args); return origSpawnSync.apply(this, arguments); };
-const origExecFile = cp.execFile; cp.execFile = function(file, args, opts, cb) { guardArgs(file, args); return origExecFile.apply(this, arguments); };
-const origExecFileSync = cp.execFileSync; cp.execFileSync = function(file, args, opts) { guardArgs(file, args); return origExecFileSync.apply(this, arguments); };
-const origExec = cp.exec; cp.exec = function(cmd, opts, cb) { guardArgs(cmd, [cmd]); return origExec.apply(this, arguments); };
-const origExecSync = cp.execSync; cp.execSync = function(cmd, opts) { guardArgs(cmd, [cmd]); return origExecSync.apply(this, arguments); };
-const fsMod = require('node:fs');
-function guardFs(p, isWrite) {
-  if (!p || typeof p !== 'string') return;
-  const isAbs = path.isAbsolute(p);
-  const isUp = p.startsWith('..');
-  if (!isAbs && !isUp) return;
-  const resolved = path.resolve(process.cwd(), p);
-  const checkRoots = isWrite ? [process.cwd(), process.env.HOME].filter(Boolean) : allowed;
-  const ok = checkRoots.some(r => r && (resolved === r || resolved.startsWith(r + path.sep)));
-  if (!ok) throw new Error('ERR_ACCESS_DENIED: fs access outside sandbox: ' + p);
-}
-const origRF = fsMod.readFileSync; fsMod.readFileSync = function(p) { guardFs(p, false); return origRF.apply(this, arguments); };
-const origWF = fsMod.writeFileSync; fsMod.writeFileSync = function(p) { guardFs(p, true); return origWF.apply(this, arguments); };
-const origAF = fsMod.appendFileSync; fsMod.appendFileSync = function(p) { guardFs(p, true); return origAF.apply(this, arguments); };
-`
+      const fenceCode = generateFenceCode({ allowedReads, hasOsSandbox })
       fsSync.writeFileSync(fenceFile, fenceCode, 'utf8')
 
-      const permOpts = `--permission ${allowedReads.map((p) => `--allow-fs-read=${p}`).join(' ')} --allow-fs-write=${executionDir} --allow-fs-write=${effectiveHome} --allow-child-process --require ${fenceFile}`
+      const permOpts = buildPermOpts({
+        allowedReads,
+        executionDir,
+        effectiveHome,
+        fenceFile,
+        hasOsSandbox,
+      })
+
       const nodePath = path.join(cwd, 'node_modules')
       const env = getScrubbedEnv({
         HOME: effectiveHome,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.55",
+  "version": "0.2.56",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",