@goodandready/dsh-moa 0.2.55 → 0.2.57

package/lib/moa-test-gate.js

@@ -1,3 +1,11 @@
+/**
+ * DeepSeek Harness Mixture of Agents (MoA) — Test Execution Gate (#161, #242, #260)
+ *
+ * Runs candidate code through verification tests in an isolated sandbox.
+ * Enforces Node.js permission model containment, fence interception,
+ * and rejection of child process evasion without OS-level isolation.
+ */
+
 import os from 'node:os'
 import fs from 'node:fs/promises'
 import fsSync from 'node:fs'
@@ -6,31 +14,20 @@ import { spawn } from 'node:child_process'
 import { resolveCandidateFolder } from './file-workspace.js'
 import { bestEffort } from './best-effort.js'
 import { logger } from './logger.js'
+import {
+  isSandboxEvasion,
+  isOsSandboxAvailable,
+  resolveTestCommand,
+  scanPathTokensForLeak,
+  getScrubbedEnv,
+  buildPermOpts,
+  generateFenceCode,
+} from './moa-sandbox.js'
+
+export { getScrubbedEnv, scanPathTokensForLeak }
 
 const MAX_CAPTURE_BYTES = 256 * 1024
 
-/**
- * Returns a sanitized environment stripping sensitive tokens and secrets (#161).
- */
-export function getScrubbedEnv(overrides = {}) {
-  const safeVars = new Set([
-    'PATH', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TMPDIR', 'TEMP', 'TMP',
-    'USER', 'LOGNAME', 'HOME', 'SHELL', 'TERM', 'NODE_ENV', 'SYSTEMROOT',
-    'WINDIR', 'COMSPEC', 'PATHEXT',
-  ])
-  const scrubbed = {}
-  for (const [key, val] of Object.entries(process.env)) {
-    if (!val || key.startsWith('MOA_')) continue
-    if (/(API_KEY|TOKEN|SECRET|PASSWORD|PASSWD|AUTH|CREDENTIAL|PRIVATE|KEY|ACCESS)/i.test(key)) {
-      continue
-    }
-    if (safeVars.has(key) || key.startsWith('LC_')) {
-      scrubbed[key] = val
-    }
-  }
-  return { ...scrubbed, ...overrides }
-}
-
 /**
  * Resolves the directory for candidate sandbox.
  */
@@ -43,46 +40,6 @@ export function resolveCandidateDir(baseDir, candidateIndex, options = {}) {
   }
 }
 
-export function decodeEscapedStrings(str) {
-  if (!str || typeof str !== 'string') return ''
-  return str.replace(/\\+/g, '\\').replace(/\\(?:([0-7]{1,3})|x([0-9a-fA-F]{2}))/g, (m, oct, hex) =>
-    oct ? String.fromCharCode(parseInt(oct, 8)) : hex ? String.fromCharCode(parseInt(hex, 16)) : m
-  )
-}
-
-const COMPUTED_SHELL_EVASION = /(?:base64\s+(?:-d|--decode|-D)[^|\n;]*\|\s*(?:ba|z|da)?sh|\beval\s+["']?\$|\bxxd\s+-r[^|\n;]*\|\s*(?:ba|z|da)?sh|\bprintf\s+[^|\n]+\|\s*(?:ba|z|da)?sh|\bopenssl\s+enc\s+-d[^|\n;]*\|\s*(?:ba|z|da)?sh|\bprintf\s+(?:%s|["']%s["'])\s+.*["'](?:\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\$\(\s*(?:printf|echo)\s+.*["'](?:\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\x60\s*(?:printf|echo)\s+.*["'](?:\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\b(?:cat|head|tail|source|\.|touch|rm|cp|mv)\s+["']?\$[A-Za-z_]|>\s*["']?\$[A-Za-z_]|>>\s*["']?\$[A-Za-z_])/i
-
-const UNIX_ROOT_PREFIX = /^\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run\/(?:user\/\d+|systemd|lock|credentials|secrets|udev|initramfs|mount|shm|dbus|sshd|motd)|sbin|boot|Users\/(?:[a-zA-Z0-9_\-.]+)|Applications|Library|System|Volumes|private)(?:\/|$)/
-
-/**
- * Validates that an executed script or command does not reference files outside allowed roots (#161, #225).
- */
-function scanPathTokensForLeak(text, allowedRoots, executionDir) {
-  if (!text || typeof text !== 'string') return null
-  const checkText = (t) => {
-    const sanitized = t.replace(/https?:\/\/[^\s"'<>]+/gi, '').replace(/\b(?:node|file|npm|data):[^\s"'<>]+/gi, '')
-    const matches = sanitized.match(/(?:[a-zA-Z]:[\\/][^\s"'<>]+|(?<![\w.@\/\\])\/(?:[a-zA-Z0-9_\-.]+\/)*[a-zA-Z0-9_\-.]+|(?<![\w.@\/\\])\.\.[\\/][^\s"'<>]*)/g) || []
-    for (const raw of matches) {
-      if (/^\/(usr\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\/|$)/.test(raw) && !/\.(txt|json|env|npmrc|key|ssh|md)/i.test(raw)) continue
-      const isAbs = path.isAbsolute(raw)
-      if ((!isAbs && !raw.startsWith('..')) || (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(raw))) continue
-      const resolved = path.resolve(executionDir, raw)
-      if (!allowedRoots.some((r) => r && (resolved === r || resolved.startsWith(r + path.sep)))) return raw
-    }
-    return null
-  }
-  const rawLeak = checkText(text)
-  if (rawLeak) return rawLeak
-  const segmented = text.match(/\bprintf\s+(?:%s|['"]%s['"])\s+((?:['"][^'"]*['"]\s*)+)/i)
-  if (segmented) {
-    const assembled = (segmented[1].match(/['"]([^'"]*)['"]/g) || []).map((s) => s.slice(1, -1)).join('')
-    const assembledLeak = checkText(assembled)
-    if (assembledLeak) return assembledLeak
-  }
-  const decoded = decodeEscapedStrings(text)
-  return decoded !== text ? checkText(decoded) : null
-}
-
 /**
  * Executes a test command in a candidate sandbox or ephemeral test staging directory.
  */
@@ -142,10 +99,10 @@ export async function runCandidateTestGate({
       return res
     }
 
-    let resolvedCmd = trimmedCmd
-    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{candidateDir}', candidateDir)
-    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{baseDir}', cwd)
-    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{stageDir}', executionDir)
+    let resolvedCmd = resolveTestCommand({ testCommand: trimmedCmd, executionDir })
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '<CANDIDATE_DIR>', executionDir)
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{candidateDir}', executionDir)
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '$CANDIDATE_DIR', executionDir)
 
     let exitCode = 0
     let stdout = ''
@@ -163,7 +120,9 @@ export async function runCandidateTestGate({
       stderr = customRes?.stderr || ''
     } else {
       const allowedRoots = [executionDir, cwd, ...(candidateDir && candidateDir !== executionDir ? [candidateDir] : [])]
-      if (COMPUTED_SHELL_EVASION.test(resolvedCmd)) {
+      
+      const cmdEvasion = isSandboxEvasion(resolvedCmd)
+      if (cmdEvasion) {
         const durationMs = Date.now() - startTime
         return {
           candidateIndex,
@@ -171,7 +130,7 @@ export async function runCandidateTestGate({
           exitCode: 1,
           durationMs,
           command: resolvedCmd,
-          output: 'Access denied: test command contains obfuscated or computed command execution',
+          output: `Access denied: test command contains ${cmdEvasion}`,
           summary: `FAIL (code 1, ${durationMs}ms)`,
         }
       }
@@ -201,7 +160,7 @@ export async function runCandidateTestGate({
         }
       }
 
-      // 2. Scan script files referenced by command or present in candidate workspace (#161)
+      // 2. Scan script files referenced by command or present in candidate workspace (#161, #260)
       const candFiles = fsSync.existsSync(executionDir) ? fsSync.readdirSync(executionDir, { recursive: true }) : []
       const scriptTokens = new Set([
         ...cmdTokens.map((t) => t.replace(/^["']|["']$/g, '')),
@@ -213,7 +172,8 @@ export async function runCandidateTestGate({
         if (fsSync.existsSync(scriptPath) && !fsSync.statSync(scriptPath).isDirectory()) {
           try {
             const scriptText = fsSync.readFileSync(scriptPath, 'utf8')
-            if (COMPUTED_SHELL_EVASION.test(scriptText)) {
+            const scriptEvasion = isSandboxEvasion(scriptText)
+            if (scriptEvasion) {
               const durationMs = Date.now() - startTime
               return {
                 candidateIndex,
@@ -221,7 +181,7 @@ export async function runCandidateTestGate({
                 exitCode: 1,
                 durationMs,
                 command: resolvedCmd,
-                output: 'Access denied: test script contains obfuscated or computed command execution',
+                output: `Access denied: test script contains ${scriptEvasion}`,
                 summary: `FAIL (code 1, ${durationMs}ms)`,
               }
             }
@@ -244,13 +204,14 @@ export async function runCandidateTestGate({
         }
       }
 
-      // 3. Scan package.json scripts if package.json exists in executionDir (#161, #206)
+      // 3. Scan package.json scripts if package.json exists in executionDir (#161, #206, #260)
       const candPkgFile = path.join(executionDir, 'package.json')
       if (fsSync.existsSync(candPkgFile)) {
         try {
           const pkgObj = JSON.parse(fsSync.readFileSync(candPkgFile, 'utf8'))
           const scriptsContent = Object.values(pkgObj.scripts || {}).join('\n')
-          if (COMPUTED_SHELL_EVASION.test(scriptsContent)) {
+          const pkgEvasion = isSandboxEvasion(scriptsContent)
+          if (pkgEvasion) {
             const durationMs = Date.now() - startTime
             return {
               candidateIndex,
@@ -258,7 +219,7 @@ export async function runCandidateTestGate({
               exitCode: 1,
               durationMs,
               command: resolvedCmd,
-              output: 'Access denied: package.json test script contains obfuscated or computed command execution',
+              output: `Access denied: package.json test script contains ${pkgEvasion}`,
               summary: `FAIL (code 1, ${durationMs}ms)`,
             }
           }
@@ -304,90 +265,20 @@ export async function runCandidateTestGate({
           : ['/usr', '/lib', '/lib64', '/etc']),
       ].filter(Boolean)
 
-      // Create security fence module for child process containment (#161, #206)
+      // Create security fence module for child process containment (#161, #206, #260)
+      const hasOsSandbox = isOsSandboxAvailable()
       fenceFile = path.join(executionDir, `.moa-fence-${Date.now()}.cjs`)
-      const fenceCode = `
-const cp = require('node:child_process');
-const path = require('node:path');
-const allowed = ${JSON.stringify(allowedReads)};
-function decodeEscaped(str) {
-  if (!str || typeof str !== 'string') return '';
-  const norm = str.split(/\\+/).join(String.fromCharCode(92));
-  return norm.replace(new RegExp(String.fromCharCode(92, 92) + '(?:([0-7]{1,3})|x([0-9a-fA-F]{2}))', 'g'), (m, oct, hex) => {
-    if (oct) return String.fromCharCode(parseInt(oct, 8));
-    if (hex) return String.fromCharCode(parseInt(hex, 16));
-    return m;
-  });
-}
-const COMPUTED_SHELL_EVASION = /(?:base64\\s+(?:-d|--decode|-D)[^|\\n;]*\\|\\s*(?:ba|z|da)?sh|\\beval\\s+["']?\\$|\\bxxd\\s+-r[^|\\n;]*\\|\\s*(?:ba|z|da)?sh|\\bprintf\\s+[^|\\n]+\\|\\s*(?:ba|z|da)?sh|\\bopenssl\\s+enc\\s+-d[^|\\n;]*\\|\\s*(?:ba|z|da)?sh|\\bprintf\\s+(?:%s|["']%s["'])\\s+.*["'](?:\\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\\$\\(\\s*(?:printf|echo)\\s+.*["'](?:\\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\\x60\\s*(?:printf|echo)\\s+.*["'](?:\\/|mnt|home|tmp|etc|var|usr|root|opt)["']|\\b(?:cat|head|tail|source|\\.|touch|rm|cp|mv)\\s+["']?\\$[A-Za-z_]|>\\s*["']?\\$[A-Za-z_]|>>\\s*["']?\\$[A-Za-z_])/i;
-const UNIX_ROOT_PREFIX = /^\\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run\\/(?:user\\/\\d+|systemd|lock|credentials|secrets|udev|initramfs|mount|shm|dbus|sshd|motd)|sbin|boot|Users\\/(?:[a-zA-Z0-9_\\-.]+)|Applications|Library|System|Volumes|private)(?:\\/|$)/;
-function checkSinglePath(p) {
-  if (!p || typeof p !== 'string') return true;
-  if (/^\\/(usr\\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\\/|$)/.test(p) && !/\\.(txt|json|env|npmrc|key|ssh|md)/i.test(p)) return true;
-  const isAbs = path.isAbsolute(p);
-  const isUp = p.startsWith('..');
-  if (!isAbs && !isUp) return true;
-  if (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(p)) return true;
-  const res = path.resolve(process.cwd(), p);
-  return allowed.some(root => root && (res === root || res.startsWith(root + path.sep)));
-}
-function scanStringForPaths(str) {
-  if (!str || typeof str !== 'string') return true;
-  if (!checkSinglePath(str)) return false;
-  const dec = decodeEscaped(str);
-  if (dec !== str && !checkSinglePath(dec)) return false;
-  const matches = str.match(/(?:[a-zA-Z]:[\\\\/][^\\s"'<>]+|(?<![\\w.@/\\\\])\\/(?:[a-zA-Z0-9_\\-.]+\\/)*[a-zA-Z0-9_\\-.]+|(?<![\\w.@/\\\\])\\.\\.[\\\\/][^\\s"'<>]*)/g) || [];
-  for (const m of matches) {
-    if (!checkSinglePath(m)) return false;
-  }
-  if (dec !== str) {
-    const decMatches = dec.match(/(?:[a-zA-Z]:[\\\\/][^\\s"'<>]+|(?<![\\w.@/\\\\])\\/(?:[a-zA-Z0-9_\\-.]+\\/)*[a-zA-Z0-9_\\-.]+|(?<![\\w.@/\\\\])\\.\\.[\\\\/][^\\s"'<>]*)/g) || [];
-    for (const m of decMatches) {
-      if (!checkSinglePath(m)) return false;
-    }
-  }
-  return true;
-}
-function guardArgs(cmd, args) {
-  const full = [cmd, ...(Array.isArray(args) ? args : [])].join(' ');
-  if (COMPUTED_SHELL_EVASION.test(full)) {
-    throw new Error('ERR_ACCESS_DENIED: child process computed execution pattern blocked: ' + full);
-  }
-  if (cmd && !scanStringForPaths(String(cmd))) {
-    throw new Error('ERR_ACCESS_DENIED: child process command outside sandbox: ' + cmd);
-  }
-  if (Array.isArray(args)) {
-    for (const a of args) {
-      if (a && !scanStringForPaths(String(a))) {
-        throw new Error('ERR_ACCESS_DENIED: child process argument outside sandbox: ' + a);
-      }
-    }
-  }
-}
-const origSpawn = cp.spawn; cp.spawn = function(cmd, args, opts) { guardArgs(cmd, args); return origSpawn.apply(this, arguments); };
-const origSpawnSync = cp.spawnSync; cp.spawnSync = function(cmd, args, opts) { guardArgs(cmd, args); return origSpawnSync.apply(this, arguments); };
-const origExecFile = cp.execFile; cp.execFile = function(file, args, opts, cb) { guardArgs(file, args); return origExecFile.apply(this, arguments); };
-const origExecFileSync = cp.execFileSync; cp.execFileSync = function(file, args, opts) { guardArgs(file, args); return origExecFileSync.apply(this, arguments); };
-const origExec = cp.exec; cp.exec = function(cmd, opts, cb) { guardArgs(cmd, [cmd]); return origExec.apply(this, arguments); };
-const origExecSync = cp.execSync; cp.execSync = function(cmd, opts) { guardArgs(cmd, [cmd]); return origExecSync.apply(this, arguments); };
-const fsMod = require('node:fs');
-function guardFs(p, isWrite) {
-  if (!p || typeof p !== 'string') return;
-  const isAbs = path.isAbsolute(p);
-  const isUp = p.startsWith('..');
-  if (!isAbs && !isUp) return;
-  const resolved = path.resolve(process.cwd(), p);
-  const checkRoots = isWrite ? [process.cwd(), process.env.HOME].filter(Boolean) : allowed;
-  const ok = checkRoots.some(r => r && (resolved === r || resolved.startsWith(r + path.sep)));
-  if (!ok) throw new Error('ERR_ACCESS_DENIED: fs access outside sandbox: ' + p);
-}
-const origRF = fsMod.readFileSync; fsMod.readFileSync = function(p) { guardFs(p, false); return origRF.apply(this, arguments); };
-const origWF = fsMod.writeFileSync; fsMod.writeFileSync = function(p) { guardFs(p, true); return origWF.apply(this, arguments); };
-const origAF = fsMod.appendFileSync; fsMod.appendFileSync = function(p) { guardFs(p, true); return origAF.apply(this, arguments); };
-`
+      const fenceCode = generateFenceCode({ allowedReads, hasOsSandbox })
       fsSync.writeFileSync(fenceFile, fenceCode, 'utf8')
 
-      const permOpts = `--permission ${allowedReads.map((p) => `--allow-fs-read=${p}`).join(' ')} --allow-fs-write=${executionDir} --allow-fs-write=${effectiveHome} --allow-child-process --require ${fenceFile}`
+      const permOpts = buildPermOpts({
+        allowedReads,
+        executionDir,
+        effectiveHome,
+        fenceFile,
+        hasOsSandbox,
+      })
+
       const nodePath = path.join(cwd, 'node_modules')
       const env = getScrubbedEnv({
         HOME: effectiveHome,