@goodandready/dsh-agent-orchestrator 0.1.9 → 0.1.11

package/lib/client.js

@@ -897,7 +897,14 @@ window.__ModuleLoader__.load({
           if (res.ok) {
             const data = await res.json()
             const active = (data.activePipelines || [])[0] || null
-            setActivePipeline(active)
+            setActivePipeline((prev) => {
+              if (!prev && !active) return null
+              if (!prev || !active) return active
+              if (prev.pipelineId === active.pipelineId && prev.status === active.status && prev.durationMs === active.durationMs) {
+                return prev
+              }
+              return active
+            })
 
             // If no active, check recent completed/failed within last 60 seconds
             if (!active && data.recentPipelines && data.recentPipelines.length > 0) {
@@ -917,12 +924,14 @@ window.__ModuleLoader__.load({
         }
       }, [dismissedId])
 
+      const hasActive = Boolean(activePipeline)
+
       useEffect(() => {
         pollStatus()
-        const intervalMs = activePipeline ? 2000 : 5000
+        const intervalMs = hasActive ? 2000 : 5000
         const timer = setInterval(pollStatus, intervalMs)
         return () => clearInterval(timer)
-      }, [activePipeline, pollStatus])
+      }, [hasActive, pollStatus])
 
       const handleCancel = async (pipelineId) => {
         try {

package/lib/http-guard.js

@@ -3,9 +3,10 @@
  * against drive-by CSRF, unauthorized cross-network access, and cross-origin tampering.
  *
  * Implements Issue #113:
- * 1. Loopback / Origin / Host validation
- * 2. Sec-Fetch-Site and Referer verification
- * 3. Body size limiter (default 1MB) with fail-closed rejection
+ * 1. Loopback / Origin / Host validation with LAN reverse proxy (X-Forwarded-Host) support
+ * 2. Sec-Fetch-Site and Referer verification (Fetch Metadata is not authentication)
+ * 3. Explicit Bearer token authorization support (bridge path)
+ * 4. Body size limiter (default 1MB) with fail-closed rejection
  */
 
 export const DEFAULT_MAX_BODY_BYTES = 1024 * 1024 // 1MB
@@ -32,56 +33,97 @@ export function getClientIp(req) {
 /**
  * Checks whether an incoming HTTP request is safe for mutation or sensitive dispatch.
  *
- * Requirements:
- * 1. If Origin header is present:
- *    - must not be "null" or empty
- *    - parsed Origin host must match Host header
- * 2. If Referer header is present:
- *    - parsed Referer host must match Host header
- * 3. If Sec-Fetch-Site header is present:
- *    - must be "same-origin" or "none" (cross-site and same-site are rejected)
- * 4. If neither Origin nor Sec-Fetch-Site is present:
- *    - only local loopback clients (127.0.0.1, ::1) are permitted.
+ * Requirements (Issue #113):
+ * 1. Authorization header:
+ *    - Bearer token accepted if matching server tokens or valid non-empty token when no static secret enforced.
+ * 2. Sec-Fetch-Site header:
+ *    - Must NOT be "cross-site" or "same-site" (fail-closed rejection).
+ * 3. Origin / Referer:
+ *    - If present, must not be "null" or empty.
+ *    - Parsed Origin host must match Host or X-Forwarded-Host.
+ * 4. Browser Same-Origin:
+ *    - When Origin is present and matches Host / X-Forwarded-Host, request is permitted.
+ * 5. Non-browser / header-only callers:
+ *    - Sec-Fetch-Site alone without matching Origin is NOT auth.
+ *    - Without Origin or Authorization, only local loopback (127.0.0.1, ::1) callers are permitted.
  */
 export function isTrustedWriteRequest(req) {
   const headers = req.headers || {}
-  const host = headers.host || ''
+  const rawHost = headers.host || ''
+  const forwardedHost = headers['x-forwarded-host'] || ''
+  const effectiveHost = forwardedHost || rawHost
+
+  // 1. Explicit Authorization header (Bridge / CLI / API token)
+  const authHeader = headers.authorization
+  const expectedToken = process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN || process.env.ORCHESTRATOR_API_KEY
+  if (authHeader && typeof authHeader === 'string' && authHeader.startsWith('Bearer ')) {
+    const token = authHeader.slice(7).trim()
+    if (token && (!expectedToken || token === expectedToken)) {
+      return true
+    }
+  }
 
+  // 2. Fetch Metadata check: reject cross-site and same-site requests upfront
+  const site = headers['sec-fetch-site']
+  if (site !== undefined && site) {
+    if (site !== 'same-origin' && site !== 'none') {
+      return false
+    }
+  }
+
+  // 3. Origin check if present
   const origin = headers.origin
   if (origin !== undefined) {
     if (origin === 'null' || !origin) return false
     try {
       const parsed = new URL(origin)
-      if (parsed.host && host && parsed.host !== host) return false
+      const originHost = parsed.host
+      if (!originHost) return false
+      if (originHost !== effectiveHost && originHost !== rawHost) {
+        return false
+      }
     } catch {
       return false
     }
   }
 
+  // 4. Referer check if present
   const referer = headers.referer
   if (referer !== undefined && referer) {
     try {
       const parsed = new URL(referer)
-      if (parsed.host && host && parsed.host !== host) return false
+      const refHost = parsed.host
+      if (!refHost) return false
+      if (refHost !== effectiveHost && refHost !== rawHost) {
+        return false
+      }
     } catch {
       return false
     }
   }
 
-  const site = headers['sec-fetch-site']
-  if (site !== undefined && site) {
-    if (site !== 'same-origin' && site !== 'none') return false
-  }
-
-  // If both origin and sec-fetch-site are absent, permit only loopback callers
-  if (origin === undefined && site === undefined) {
-    const ip = getClientIp(req)
-    if (!isLoopbackAddress(ip)) {
+  // 5. If origin is present and matches effectiveHost/rawHost:
+  if (origin && (effectiveHost || rawHost)) {
+    try {
+      const parsed = new URL(origin)
+      if (parsed.host === effectiveHost || parsed.host === rawHost) {
+        return true
+      }
+    } catch {
       return false
     }
   }
 
-  return true
+  // 6. If origin is absent, check for local loopback:
+  // Fetch metadata alone (e.g. Sec-Fetch-Site: same-origin) is NOT authentication.
+  // Header-only remote callers without Origin or Authorization are rejected.
+  const ip = getClientIp(req)
+  if (isLoopbackAddress(ip)) {
+    // Local loopback caller without origin (CLI, server scripts) is allowed.
+    return true
+  }
+
+  return false
 }
 
 export function rejectUntrustedRequest(req, res) {

package/lib/index.js

@@ -8,10 +8,16 @@
 import { randomUUID } from 'crypto'
 // Safe peerDependency resolution with standalone fallback
 function createSchemaStub(target = {}) {
-  return new Proxy(target, {
+  const fn = (...args) => createSchemaStub({ ...target, args })
+  fn.shape = target.shape || {}
+  fn.meta = target.meta || {}
+  fn.volatile = () => createSchemaStub({ ...target, meta: { ...(target.meta || {}), volatile: true } })
+  return new Proxy(fn, {
     get(t, prop) {
       if (prop === 'shape') return t.shape || {}
-      return (...args) => createSchemaStub({ ...t, [prop]: args[0] })
+      if (prop === 'meta') return t.meta || {}
+      if (prop === 'volatile') return () => createSchemaStub({ ...target, meta: { ...(target.meta || {}), volatile: true } })
+      return (...args) => createSchemaStub({ ...target, [prop]: args[0] })
     }
   })
 }
@@ -28,6 +34,18 @@ try {
     number: () => createSchemaStub({ type: 'number' }),
     union: () => createSchemaStub({ type: 'union' }),
     array: () => createSchemaStub({ type: 'array' }),
+    any: () => createSchemaStub({ type: 'any' }),
+  }
+}
+
+// DSH SettingsForms describe only publishes fields marked volatile. Without them the
+// namespace is omitted and the configuration page stays unavailable.
+if (typeof z.prototype?.volatile !== 'function') {
+  if (z.prototype) {
+    z.prototype.volatile = function volatile() {
+      if (this.meta && this.meta.volatile) return this
+      return typeof this.extra === 'function' ? this.extra('volatile', true) : this
+    }
   }
 }
 
@@ -58,16 +76,19 @@ export const name = '@goodandready/dsh-agent-orchestrator'
 export const inject = ['settings', 'webServer', 'llm', 'tools', 'commands', 'systemPrompt', 'subagents']
 
 export const Config = z.object({
-  enabled: z.boolean().default(true).description('Enable Multi-Agent Orchestrator pipeline dispatcher'),
-  defaultScenario: z.string().default('auto').description('Default complexity scenario (auto, hotfix, simple, medium, complex, enterprise)'),
-  disableNestedDelegation: z.boolean().default(false).description('Anti-Matryoshka Guard: Disallow subagents from spawning nested subagents (Issue #19)'),
-  maxConcurrentSubagents: z.number().default(3).description('Maximum concurrent subagents per parent session (Issue #93)'),
-  subagentGracePeriodMs: z.number().default(180000).description('Grace period before archiving completed one-shot subagents (Issue #56)'),
-  smartModelRouting: z.boolean().default(false).description('Smart Model Routing: dynamically select model based on task complexity (Issue #48)'),
-  allowedProviders: z.array(z.string()).default([]).description('Whitelist of allowed LLM provider IDs (Issue #48)'),
-  failFastModelValidation: z.boolean().default(false).description('Fail-fast when requested model is not found in provider registry (Issue #82)'),
-  maxStoredSessions: z.number().default(400).description('Capacity recycling threshold for subagent sessions (Issue #67)'),
-  sessionRetentionMs: z.number().default(86400000).description('Retention duration in ms for sessions-archive before physical deletion (Issue #57)'),
+  enabled: z.boolean().default(true).description('Enable Multi-Agent Orchestrator pipeline dispatcher').volatile(),
+  defaultScenario: z.string().default('auto').description('Default complexity scenario (auto, hotfix, simple, medium, complex, enterprise)').volatile(),
+  disableNestedDelegation: z.boolean().default(false).description('Anti-Matryoshka Guard: Disallow subagents from spawning nested subagents (Issue #19)').volatile(),
+  maxConcurrentSubagents: z.number().default(3).description('Maximum concurrent subagents per parent session (Issue #93)').volatile(),
+  subagentGracePeriodMs: z.number().default(180000).description('Grace period before archiving completed one-shot subagents (Issue #56)').volatile(),
+  smartModelRouting: z.boolean().default(false).description('Smart Model Routing: dynamically select model based on task complexity (Issue #48)').volatile(),
+  allowedProviders: z.array(z.string()).default([]).description('Whitelist of allowed LLM provider IDs (Issue #48)').volatile(),
+  failFastModelValidation: z.boolean().default(false).description('Fail-fast when requested model is not found in provider registry (Issue #82)').volatile(),
+  maxStoredSessions: z.number().default(400).description('Capacity recycling threshold for subagent sessions (Issue #67)').volatile(),
+  sessionRetentionMs: z.number().default(86400000).description('Retention duration in ms for sessions-archive before physical deletion (Issue #57)').volatile(),
+  roles: (typeof z.any === 'function' ? z.any() : z.object({})).default(null).description('Custom specialist roles roster').volatile(),
+  scenarios: (typeof z.any === 'function' ? z.any() : z.object({})).default(null).description('Custom execution scenarios DAG dictionary').volatile(),
+  kanbanSync: (typeof z.any === 'function' ? z.any() : z.object({})).default(null).description('Kanban board synchronization configuration').volatile(),
 })
 
 export function apply(ctx, config = {}) {
@@ -96,45 +117,142 @@ export function apply(ctx, config = {}) {
     },
   }
 
-  let settingsScope = null
+  const applyLoadedConfig = (saved) => {
+    if (!saved || typeof saved !== 'object') return
+    const mergedRoles = saved.roles || currentSettings.roles || getDefaultRoles()
+    const mergedScenarios = saved.scenarios || currentSettings.scenarios || getDefaultScenarios()
+    const syncRes = syncDefaultPresets({
+      currentRoles: mergedRoles,
+      currentScenarios: mergedScenarios,
+      logger,
+    })
+    currentSettings = {
+      ...currentSettings,
+      ...saved,
+      disableNestedDelegation: saved.disableNestedDelegation ?? currentSettings.disableNestedDelegation,
+      smartModelRouting: saved.smartModelRouting ?? currentSettings.smartModelRouting,
+      allowedProviders: Array.isArray(saved.allowedProviders) ? saved.allowedProviders : currentSettings.allowedProviders,
+      failFastModelValidation: saved.failFastModelValidation ?? currentSettings.failFastModelValidation,
+      maxStoredSessions: saved.maxStoredSessions ?? currentSettings.maxStoredSessions,
+      sessionRetentionMs: saved.sessionRetentionMs ?? currentSettings.sessionRetentionMs,
+      roles: syncRes.roles,
+      scenarios: syncRes.scenarios,
+      kanbanSync: { ...currentSettings.kanbanSync, ...(saved.kanbanSync || {}) },
+    }
+  }
 
-  // Register settings scope
-  ctx.inject(['settings'], (sctx) => {
-    try {
-      const scope = sctx.settings.register(NS, Config, { base: config })
-      if (scope) {
-        settingsScope = scope
-        const saved = scope.get()
-        if (saved) {
-          currentSettings = {
-            ...currentSettings,
-            ...saved,
-            disableNestedDelegation: saved.disableNestedDelegation ?? currentSettings.disableNestedDelegation,
-            roles: saved.roles || getDefaultRoles(),
-            scenarios: saved.scenarios || getDefaultScenarios(),
-            kanbanSync: { ...currentSettings.kanbanSync, ...(saved.kanbanSync || {}) },
+  let settingsAdapter = null
+
+  const createSettingsAdapter = (svc) => {
+    if (!svc) return null
+
+    // Legacy DSH settings service (v0.1.6 and earlier)
+    if (typeof svc.register === 'function') {
+      const scope = svc.register(NS, Config, { base: config })
+      return {
+        type: 'legacy',
+        get: () => scope?.get?.(),
+        persist: async (fullConfig) => {
+          if (!scope?.set) return
+          for (const [k, v] of Object.entries(fullConfig)) {
+            try {
+              await scope.set(k, v)
+            } catch (err) {
+              logger.debug('[dsh-agent-orchestrator] Legacy setting set warning:', k, err?.message || err)
+            }
           }
+        },
+        watch: (cb) => {
+          if (typeof scope?.watch === 'function') return scope.watch(cb)
+          return () => {}
+        },
+      }
+    }
+
+    // Modern DSH SettingsForms service (v0.1.7-rc.1+)
+    if (typeof svc.replace === 'function' || typeof svc.update === 'function') {
+      const resolveNsAndRevision = () => {
+        try {
+          const list = typeof svc.describe === 'function' ? svc.describe() : []
+          const entry = list.find((row) => row.ns === name || row.ns === NS || row.ns?.includes('dsh-agent-orchestrator'))
+          if (entry) {
+            return { ns: entry.ns, revision: entry.revision, value: entry.value }
+          }
+        } catch (err) {
+          logger.debug('[dsh-agent-orchestrator] Settings describe error:', err?.message || err)
         }
+        return { ns: NS, revision: undefined, value: undefined }
+      }
+
+      return {
+        type: 'modern',
+        get: () => {
+          const { value } = resolveNsAndRevision()
+          return value
+        },
+        persist: async (fullConfig) => {
+          const { ns: targetNs, revision } = resolveNsAndRevision()
+          if (typeof svc.replace === 'function') {
+            await svc.replace(targetNs, fullConfig, revision)
+          } else if (typeof svc.update === 'function') {
+            await svc.update(targetNs, fullConfig, revision)
+          } else {
+            throw new Error('Settings service does not support replace or update')
+          }
+        },
+        watch: (cb) => {
+          if (typeof ctx.on === 'function') {
+            return ctx.on('settings/document-updated', (id) => {
+              if (id === name || id === NS || id?.includes('dsh-agent-orchestrator')) {
+                const { value } = resolveNsAndRevision()
+                cb(value)
+              }
+            })
+          }
+          return () => {}
+        },
       }
-    } catch (e) {
-      logger.warn('[dsh-agent-orchestrator] Settings register warning:', e?.message || e)
     }
-  })
 
-  const getConfig = () => currentSettings
-  const updateConfig = async (partial) => {
-    currentSettings = { ...currentSettings, ...partial }
-    if (settingsScope) {
+    return null
+  }
+
+  // Register settings scope or adapter
+  if (typeof ctx.inject === 'function') {
+    ctx.inject(['settings'], (sctx) => {
       try {
-        for (const [k, v] of Object.entries(partial)) {
-          if (k === 'enabled' || k === 'defaultScenario' || k === 'disableNestedDelegation') {
-            await settingsScope.set(k, v)
+        settingsAdapter = createSettingsAdapter(sctx.settings)
+        if (settingsAdapter) {
+          const saved = settingsAdapter.get()
+          if (saved) {
+            applyLoadedConfig(saved)
+          }
+          if (typeof sctx.effect === 'function') {
+            sctx.effect(() => settingsAdapter.watch((next) => {
+              if (next) applyLoadedConfig(next)
+            }), 'dsh-agent-orchestrator: settings watch')
           }
         }
-      } catch (err) {
-        logger.debug('[dsh-agent-orchestrator] Settings update warning:', err?.message || err)
+      } catch (e) {
+        logger.warn('[dsh-agent-orchestrator] Settings register warning:', e?.message || e)
       }
+    })
+  }
+
+  const getConfig = () => currentSettings
+  const updateConfig = async (partial) => {
+    if (!settingsAdapter) {
+      throw new Error('Settings service is unavailable')
+    }
+    const nextSettings = {
+      ...currentSettings,
+      ...partial,
+      kanbanSync: partial?.kanbanSync
+        ? { ...currentSettings.kanbanSync, ...partial.kanbanSync }
+        : currentSettings.kanbanSync,
     }
+    await settingsAdapter.persist(nextSettings)
+    currentSettings = nextSettings
   }
 
   // Self-Syncing Presets & Roles (Issue #107)
@@ -292,10 +410,22 @@ export function apply(ctx, config = {}) {
     }
   }
 
+  const activeAbortControllers = new Map()
+
   /**
    * Runner object to start, execute, and monitor pipelines
    */
   const runner = {
+    cancelPipeline(pipelineId) {
+      const controller = activeAbortControllers.get(pipelineId)
+      if (controller) {
+        controller.abort()
+        activeAbortControllers.delete(pipelineId)
+        return true
+      }
+      return false
+    },
+
     async startPipeline({ taskTitle, taskDescription, scenarioId, taskId }) {
       const cfg = getConfig()
       const plan = decomposeTask({
@@ -369,17 +499,24 @@ export function apply(ctx, config = {}) {
         }
       }
 
+      const abortController = new AbortController()
+      activeAbortControllers.set(plan.pipelineId, abortController)
+
       executeDAG({
         stages: plan.stages,
         executor,
         concurrency: 3,
+        signal: abortController.signal,
       })
         .then(async (dagResult) => {
-          store.updatePipeline(plan.pipelineId, {
-            status: 'completed',
-            completedAt: Date.now(),
+          activeAbortControllers.delete(plan.pipelineId)
+          const currentP = store.getPipeline(plan.pipelineId)
+          if (currentP?.status === 'failed' && currentP?.error === 'Cancelled by user') {
+            return
+          }
+          store.recordCompletion(plan.pipelineId, {
+            ...dagResult,
             durationMs: Date.now() - pipelineData.startedAt,
-            artifacts: dagResult.artifacts,
           })
 
           // Sync to Kanban if enabled
@@ -399,7 +536,7 @@ export function apply(ctx, config = {}) {
                 if (syncConfig.createChecklist) {
                   const checklistItems = plan.stages.map((s) => ({
                     title: `${s.name} (${s.roleName})`,
-                    completed: dagResult.statusMap[s.id] === 'completed',
+                    completed: dagResult?.stateMap?.[s.id]?.status === 'completed',
                   }))
                   await kanbanBridge.syncStageChecklist(targetTaskId, checklistItems)
                 }
@@ -419,7 +556,7 @@ export function apply(ctx, config = {}) {
               id: plan.pipelineId,
               title: plan.taskTitle,
               scenarioId: plan.scenarioId,
-              status: dagResult.allSucceeded ? 'completed' : 'failed',
+              status: dagResult?.success ? 'completed' : 'failed',
               stages: plan.stages,
               durationMs: Date.now() - pipelineData.startedAt,
             })
@@ -428,9 +565,13 @@ export function apply(ctx, config = {}) {
           }
         })
         .catch((dagErr) => {
-          store.updatePipeline(plan.pipelineId, {
-            status: 'failed',
-            completedAt: Date.now(),
+          activeAbortControllers.delete(plan.pipelineId)
+          const currentP = store.getPipeline(plan.pipelineId)
+          if (currentP?.status === 'failed' && currentP?.error === 'Cancelled by user') {
+            return
+          }
+          store.recordCompletion(plan.pipelineId, {
+            success: false,
             durationMs: Date.now() - pipelineData.startedAt,
             error: dagErr?.message || String(dagErr),
           })
@@ -813,8 +954,11 @@ export function apply(ctx, config = {}) {
     }
   }
 
+  let hasCommandsService = false
+
   // Chat slash commands: /orchestrate and /orc via commands service
   ctx.inject(['commands'], (cctx) => {
+    hasCommandsService = true
     try {
       if (typeof cctx.commands?.register !== 'function') return
 
@@ -904,6 +1048,7 @@ export function apply(ctx, config = {}) {
 
       if (typeof cctx.effect === 'function') {
         cctx.effect(() => () => {
+          hasCommandsService = false
           try {
             if (typeof unregister1 === 'function') unregister1()
             if (typeof unregister2 === 'function') unregister2()
@@ -938,6 +1083,11 @@ export function apply(ctx, config = {}) {
       const text = String(event.text || event.content || '').trim()
       const intent = detectOrchestratorIntent(text)
 
+      // Prevent duplicate dispatch: if commands service is active, slash commands are handled by cctx.commands (#148)
+      if (hasCommandsService && intent.triggerKind === 'slash') {
+        return
+      }
+
       if (intent.isTrigger && intent.action === 'on') {
         await handlePipelineDispatch({
           taskTitle: intent.taskTitle || 'Interactive Orchestrated Task',

package/lib/pipeline/dag-engine.js

@@ -149,12 +149,14 @@ export async function executeDAG(stagesOrOptions, executorArg, optionsArg = {})
   let onNodeComplete = () => {}
   let onNodeFail = () => {}
   let onNodeBlocked = () => {}
+  let signal = null
 
   if (Array.isArray(stagesOrOptions)) {
     stages = stagesOrOptions
     executor = executorArg
     concurrency = optionsArg.concurrency || optionsArg.maxConcurrency || 4
     initialContext = optionsArg.initialContext || {}
+    signal = optionsArg.signal || null
     if (typeof optionsArg.onNodeStart === 'function') onNodeStart = optionsArg.onNodeStart
     if (typeof optionsArg.onNodeComplete === 'function') onNodeComplete = optionsArg.onNodeComplete
     if (typeof optionsArg.onNodeFail === 'function') onNodeFail = optionsArg.onNodeFail
@@ -164,6 +166,7 @@ export async function executeDAG(stagesOrOptions, executorArg, optionsArg = {})
     executor = stagesOrOptions.executor
     concurrency = stagesOrOptions.concurrency || stagesOrOptions.maxConcurrency || 4
     initialContext = stagesOrOptions.initialContext || {}
+    signal = stagesOrOptions.signal || null
     if (typeof stagesOrOptions.onNodeStart === 'function') onNodeStart = stagesOrOptions.onNodeStart
     if (typeof stagesOrOptions.onNodeComplete === 'function') onNodeComplete = stagesOrOptions.onNodeComplete
     if (typeof stagesOrOptions.onNodeFail === 'function') onNodeFail = stagesOrOptions.onNodeFail
@@ -220,13 +223,33 @@ export async function executeDAG(stagesOrOptions, executorArg, optionsArg = {})
     function triggerNext() {
       if (isDone) return
 
+      if (signal?.aborted) {
+        if (!isDone && runningCount === 0) {
+          isDone = true
+          for (const s of stages) {
+            const st = stateMap.get(s.id)
+            if (st.status === NODE_STATUS.PENDING) {
+              st.status = NODE_STATUS.SKIPPED
+            }
+          }
+          resolvePromise({
+            success: false,
+            cancelled: true,
+            durationMs: Date.now() - startTime,
+            stateMap: Object.fromEntries(stateMap),
+            artifacts: Object.fromEntries(artifacts),
+          })
+        }
+        return
+      }
+
       // Propagate blockers first
       if (markBlockedStages(stages, stateMap)) {
         for (const s of stages) {
           const st = stateMap.get(s.id)
           if (st.status === NODE_STATUS.BLOCKED && !st.notifiedBlocked) {
             st.notifiedBlocked = true
-            onNodeBlocked(st)
+            try { onNodeBlocked(st) } catch (_) { /* Safe ignore notification error */ }
           }
         }
       }
@@ -241,7 +264,7 @@ export async function executeDAG(stagesOrOptions, executorArg, optionsArg = {})
         nodeState.startedAt = Date.now()
         runningCount++
 
-        onNodeStart(nodeState)
+        try { onNodeStart(nodeState) } catch (_) { /* Safe ignore notification error */ }
 
         // Run task asynchronously
         const upstreamOutputs = {}
@@ -266,17 +289,28 @@ export async function executeDAG(stagesOrOptions, executorArg, optionsArg = {})
 
             artifacts.set(nextStage.id, nodeState.output)
             runningCount--
-            onNodeComplete(nodeState)
+            try {
+              onNodeComplete(nodeState)
+            } catch (_) {
+              /* Callback error must not alter completed state or double-decrement runningCount */
+            }
             triggerNext()
           })
           .catch((err) => {
+            if (nodeState.status === NODE_STATUS.COMPLETED) {
+              return
+            }
             nodeState.status = NODE_STATUS.FAILED
             nodeState.completedAt = Date.now()
             nodeState.durationMs = nodeState.completedAt - nodeState.startedAt
             nodeState.error = err?.message || String(err)
 
             runningCount--
-            onNodeFail(nodeState, err)
+            try {
+              onNodeFail(nodeState, err)
+            } catch (_) {
+              /* Callback error must not crash the engine */
+            }
             triggerNext()
           })
       }
@@ -284,6 +318,12 @@ export async function executeDAG(stagesOrOptions, executorArg, optionsArg = {})
       checkCompletion()
     }
 
+    if (signal) {
+      signal.addEventListener('abort', () => {
+        triggerNext()
+      }, { once: true })
+    }
+
     // Initial trigger
     triggerNext()
   })

package/lib/pipeline/delegation.js

@@ -152,8 +152,18 @@ export function normalizeRoleId(input, availableRoles = []) {
     if (role.displayName && role.displayName.toLowerCase() === lower) return role.id
   }
 
+  function matchesRoleAlias(str, alias) {
+    if (str === alias) return true
+    if (alias.length <= 3) {
+      const escaped = alias.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+      const regex = new RegExp('(^|[^a-z0-9а-яё])' + escaped + '([^a-z0-9а-яё]|$)', 'i')
+      return regex.test(str)
+    }
+    return str.includes(alias)
+  }
+
   for (const [alias, id] of Object.entries(ROLE_INPUT_ALIASES)) {
-    if (lower === alias || lower.includes(alias)) {
+    if (matchesRoleAlias(lower, alias)) {
       const found = rolesList.find((r) => r.id === id)
       if (found) return found.id
       if (id === 'code') {

package/lib/pipeline/intent.js

@@ -51,12 +51,13 @@ export function detectOrchestratorIntent(text) {
   if (slashMatch) {
     const rest = (slashMatch[1] || '').trim()
     if (rest.toLowerCase() === 'off') {
-      return { isTrigger: true, action: 'off' }
+      return { isTrigger: true, action: 'off', triggerKind: 'slash' }
     }
     const { scenarioId, taskTitle } = extractScenarioAndTask(rest)
     return {
       isTrigger: true,
       action: 'on',
+      triggerKind: 'slash',
       scenarioId,
       taskTitle,
     }
@@ -73,6 +74,7 @@ export function detectOrchestratorIntent(text) {
     return {
       isTrigger: true,
       action: 'on',
+      triggerKind: 'nl',
       scenarioId,
       taskTitle,
     }
@@ -89,6 +91,7 @@ export function detectOrchestratorIntent(text) {
     return {
       isTrigger: true,
       action: 'on',
+      triggerKind: 'nl',
       scenarioId,
       taskTitle,
     }

package/lib/pipeline/model-selection.js

@@ -569,7 +569,6 @@ export async function fetchModelCatalog(ctx, options = {}) {
     const defaultPool = [
       { provider: 'deepseek-official', model: 'deepseek-chat', maxTokens: 4096 },
       { provider: 'deepseek-official', model: 'deepseek-reasoner', maxTokens: 8192 },
-      { provider: 'anthropic', model: 'claude-3-5-sonnet', maxTokens: 8192 },
     ]
     for (const item of defaultPool) {
       const capabilities = inferModelCapabilities(item.model, item.provider)

package/lib/pipeline/snapshots.js

@@ -23,6 +23,7 @@ export class SnapshotManager {
     this.baseDir = baseDir || path.join(os.homedir(), '.dsh', 'orchestrator-snapshots')
     this.maxSnapshots = maxSnapshots
     this.logger = logger || null
+    this._snapshotsCache = null
     this._ensureDir()
   }
 
@@ -65,6 +66,9 @@ export class SnapshotManager {
    */
   listSnapshots() {
     this._ensureDir()
+    if (this._snapshotsCache) {
+      return [...this._snapshotsCache]
+    }
     try {
       const files = fs.readdirSync(this.baseDir)
       const snapshots = []
@@ -91,7 +95,8 @@ export class SnapshotManager {
         return timeB - timeA
       })
 
-      return snapshots
+      this._snapshotsCache = snapshots
+      return [...snapshots]
     } catch (err) {
       if (this.logger?.error) {
         this.logger.error('[SnapshotManager] Error listing snapshots:', err?.message || err)
@@ -158,7 +163,7 @@ export class SnapshotManager {
     const tmpPath = path.join(this.baseDir, `${snapshotId}.tmp-${Date.now()}`)
 
     try {
-      fs.writeFileSync(tmpPath, JSON.stringify(record, null, 2), 'utf8')
+      fs.writeFileSync(tmpPath, JSON.stringify(record), 'utf8')
       fs.renameSync(tmpPath, filePath)
     } catch (err) {
       try {
@@ -169,6 +174,7 @@ export class SnapshotManager {
       throw err
     }
 
+    this._snapshotsCache = null
     // Enforce FIFO retention policy: if file count > maxSnapshots, prune oldest
     this._enforceRetention()
 
@@ -179,6 +185,7 @@ export class SnapshotManager {
    * Prunes oldest snapshot files when total exceeds maxSnapshots ceiling.
    */
   _enforceRetention() {
+    this._snapshotsCache = null
     try {
       const files = fs.readdirSync(this.baseDir).filter((f) => f.endsWith('.json'))
       if (files.length <= this.maxSnapshots) return

package/lib/pipeline/worker-pool.js

@@ -84,6 +84,7 @@ export async function executeStageWorker(stage, context) {
       output: artContent || '',
     })
   }
+  priorArtifactsList.sort((a, b) => a.stageId.localeCompare(b.stageId))
   const cumulativeArtifacts = formatCumulativeArtifacts(priorArtifactsList)
 
   // 4. Assemble canonical prompt (Layer 1 + 2 + 3 in System, Layer 4 in User)

package/lib/routes.js

@@ -20,19 +20,47 @@ function jsonReply(res, data, status = 200) {
   res.end(JSON.stringify(data))
 }
 
+export function toPublicPipelineDto(pipe) {
+  if (!pipe) return null
+  const stages = Array.isArray(pipe.stages)
+    ? pipe.stages.map((s) => ({
+        id: s.id,
+        name: s.name,
+        roleId: s.roleId,
+        status: s.status,
+      }))
+    : []
+  return {
+    pipelineId: pipe.pipelineId || pipe.id,
+    scenarioId: pipe.scenarioId,
+    scenarioTitle: pipe.scenarioTitle,
+    status: pipe.status,
+    startedAt: pipe.startedAt || pipe.createdAt || null,
+    completedAt: pipe.completedAt || null,
+    durationMs: pipe.durationMs || 0,
+    stages,
+  }
+}
+
+
 export function registerOrchestratorRoutes(ctx, services) {
   const { store, runner, getConfig, updateConfig, callLlm, snapshotManager = new SnapshotManager() } = services
 
   // 1. Status & Global Metrics (Read-only status overview)
-  // Conscious architectural choice (Issue #113): Public read-only endpoint returning non-sensitive metrics
+  // Conscious architectural choice (Issue #113): Public read-only endpoint returning non-sensitive metrics only
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-agent-orchestrator/status',
     handler: (req, res) => {
+      if (req.method !== 'GET') {
+        return jsonReply(res, { error: 'Method not allowed' }, 405)
+      }
+      const active = store.getActivePipelines().map(toPublicPipelineDto)
+      const recent = store.getAllPipelines().slice(0, 10).map(toPublicPipelineDto)
       jsonReply(res, {
-        activePipelines: store.getActivePipelines(),
+        activePipelines: active,
         metrics: store.getMetrics(),
-        recentPipelines: store.getAllPipelines().slice(0, 10),
+        recentPipelines: recent,
       })
     },
   }), 'dsh-agent-orchestrator: status route')
@@ -112,6 +140,10 @@ export function registerOrchestratorRoutes(ctx, services) {
     kind: 'prefix',
     path: '/dsh-agent-orchestrator/pipeline',
     handler: (req, res) => {
+      if (req.method !== 'GET') {
+        return jsonReply(res, { error: 'Method not allowed' }, 405)
+      }
+      if (rejectUntrustedRequest(req, res)) return
       const parts = req.url.split('?')[0].split('/')
       const pipelineId = parts[parts.length - 1]
       const pipeline = store.getPipeline(pipelineId)
@@ -140,6 +172,7 @@ export function registerOrchestratorRoutes(ctx, services) {
       }
 
       const pipelineId = body.pipelineId
+      runner?.cancelPipeline?.(pipelineId)
       const p = store.getPipeline(pipelineId)
       if (p && (p.status === 'running' || p.status === 'pending')) {
         store.updatePipeline(pipelineId, {
@@ -175,9 +208,17 @@ export function registerOrchestratorRoutes(ctx, services) {
             }
           }
         }
-        await updateConfig(body)
-        return jsonReply(res, { success: true, config: getConfig() })
+        try {
+          await updateConfig(body)
+          return jsonReply(res, { success: true, config: getConfig() })
+        } catch (err) {
+          return jsonReply(res, { success: false, error: err?.message || 'Failed to persist configuration' }, 500)
+        }
       }
+      if (req.method !== 'GET') {
+        return jsonReply(res, { error: 'Method not allowed' }, 405)
+      }
+      if (rejectUntrustedRequest(req, res)) return
       jsonReply(res, { config: getConfig() })
     },
   }), 'dsh-agent-orchestrator: config route')
@@ -187,6 +228,9 @@ export function registerOrchestratorRoutes(ctx, services) {
     kind: 'exact',
     path: '/dsh-agent-orchestrator/models',
     handler: async (req, res) => {
+      if (req.method !== 'GET') {
+        return jsonReply(res, { error: 'Method not allowed' }, 405)
+      }
       const selection = readModelSelection(ctx)
       const catalog = await fetchModelCatalog(ctx, {
         allowedRoutes: selection.allowedRoutes,
@@ -204,6 +248,9 @@ export function registerOrchestratorRoutes(ctx, services) {
     kind: 'exact',
     path: '/dsh-agent-orchestrator/catalog/models',
     handler: async (req, res) => {
+      if (req.method !== 'GET') {
+        return jsonReply(res, { error: 'Method not allowed' }, 405)
+      }
       try {
         const urlObj = new URL(req.url, 'http://localhost')
         const provider = urlObj.searchParams.get('provider') || undefined
@@ -225,6 +272,10 @@ export function registerOrchestratorRoutes(ctx, services) {
     kind: 'exact',
     path: '/dsh-agent-orchestrator/snapshots',
     handler: (req, res) => {
+      if (req.method !== 'GET') {
+        return jsonReply(res, { error: 'Method not allowed' }, 405)
+      }
+      if (rejectUntrustedRequest(req, res)) return
       try {
         const snapshots = snapshotManager.listSnapshots()
         jsonReply(res, { snapshots, total: snapshots.length })

package/lib/store.js

@@ -12,9 +12,10 @@ export class OrchestratorStore {
   constructor(options = {}) {
     const opts = typeof options === 'string' ? { storageDir: options } : (options || {})
     const baseDir = opts.storageDir || join(homedir(), '.dsh')
-    this.storagePath = join(baseDir, 'orchestrator-pipelines.json')
+    this.storagePath = opts.storagePath || join(baseDir, 'orchestrator-pipelines.json')
     this.logger = opts.logger || null
     this.pipelines = new Map()
+    this._saveTimer = null
     this.globalMetrics = {
       totalPipelines: 0,
       completedPipelines: 0,
@@ -55,12 +56,23 @@ export class OrchestratorStore {
         globalMetrics: this.globalMetrics,
         updatedAt: Date.now(),
       }
-      writeFileSync(this.storagePath, JSON.stringify(serialized, null, 2), 'utf8')
+      writeFileSync(this.storagePath, JSON.stringify(serialized), 'utf8')
     } catch (e) {
       if (this.logger?.warn) this.logger.warn('[dsh-agent-orchestrator] Store save warning:', e?.message || e)
     }
   }
 
+  saveDebounced(delayMs = 150) {
+    if (this._saveTimer) return
+    this._saveTimer = setTimeout(() => {
+      this._saveTimer = null
+      this.save()
+    }, delayMs)
+    if (this._saveTimer && typeof this._saveTimer.unref === 'function') {
+      this._saveTimer.unref()
+    }
+  }
+
   recordPipeline(pipelineData) {
     this.pipelines.set(pipelineData.pipelineId, pipelineData)
     this.globalMetrics.totalPipelines++
@@ -107,7 +119,7 @@ export class OrchestratorStore {
       }
     }
 
-    this.save()
+    this.saveDebounced()
     return updated
   }
 
@@ -127,6 +139,7 @@ export class OrchestratorStore {
       p.durationMs = summary.durationMs || 0
       p.stateMap = summary.stateMap || {}
       p.artifacts = summary.artifacts || {}
+      if (summary.error) p.error = summary.error
 
       if (summary.success) {
         this.globalMetrics.completedPipelines++

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-agent-orchestrator",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Multi-agent task decomposition, DAG workflow orchestration, and prompt caching optimizer for DeepSeek Harness.",
   "type": "module",
   "main": "./lib/index.js",