@goodandready/dsh-moa 0.2.15 → 0.2.17

package/lib/routes.js

@@ -0,0 +1,412 @@
+/**
+ * DeepSeek Harness Mixture of Agents (MoA) — HTTP Route Handlers
+ */
+
+import {
+  getMoaHistory,
+  getMoaLeaderboard,
+  getMoaRunById,
+  exportMoaHistory,
+} from './history.js'
+import { promoteCandidateWorkspace } from './file-workspace.js'
+import { isSafeWriteRequest } from './updater.js'
+import { runMoAPipeline } from './moa-runner.js'
+
+function writeJson(res, status, body) {
+  res.writeHead(status, {
+    'Content-Type': 'application/json; charset=utf-8',
+    'Cache-Control': 'no-store',
+  })
+  res.end(JSON.stringify(body))
+}
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let acc = ''
+    req.on('data', (chunk) => {
+      acc += chunk
+      if (acc.length > 5 * 1024 * 1024) {
+        req.destroy()
+        reject(new Error('Payload Too Large'))
+      }
+    })
+    req.on('end', () => resolve(acc))
+    req.on('error', reject)
+  })
+}
+
+export function registerMoaRoutes(ctx, { live, callLlm, liveCanvas, getSettingsScope }) {
+  const getScope = () => (typeof getSettingsScope === 'function' ? getSettingsScope() : null)
+
+ctx.effect(() => {
+    return ctx.webServer.register({
+      kind: 'exact',
+      path: '/dsh-moa/status',
+      handler: (_req, res) => {
+        const cfg = live()
+        writeJson(res, 200, {
+          ok: true,
+          enabled: cfg.enabled !== false,
+          defaultPreset: cfg.default_preset || 'default',
+          presetsCount: (cfg.presets || []).length,
+        })
+      },
+    })
+  }, 'dsh-moa: status route')
+
+  // Route: /dsh-moa/models
+  ctx.effect(() => {
+    return ctx.webServer.register({
+      kind: 'exact',
+      path: '/dsh-moa/models',
+      handler: async (_req, res) => {
+        const result = []
+        const seen = new Set()
+
+        const add = (p, m) => {
+          if (!p || !m) return
+          const key = `${p}:${m}`
+          if (!seen.has(key)) {
+            seen.add(key)
+            result.push({ provider: p, model: m, label: key })
+          }
+        }
+
+        if (ctx.llm) {
+          try {
+            if (typeof ctx.llm.listAvailableModels === 'function') {
+              const list = await ctx.llm.listAvailableModels()
+              for (const item of (list || [])) {
+                if (item?.provider && item?.id) add(item.provider, item.id)
+              }
+            }
+          } catch (e) {
+            console.warn('[dsh-moa] ctx.llm.listAvailableModels error:', e)
+          }
+
+          try {
+            if (typeof ctx.llm.listConfigurableProviders === 'function') {
+              const cProvs = ctx.llm.listConfigurableProviders() || []
+              for (const cp of cProvs) {
+                const cpId = cp.provider || cp.id
+                if (cpId && typeof ctx.llm.listModels === 'function') {
+                  try {
+                    const mList = await ctx.llm.listModels(cpId)
+                    for (const m of (mList || [])) {
+                      const mId = typeof m === 'string' ? m : (m.id || m.model || m.name)
+                      if (mId) add(cpId, mId)
+                    }
+                  } catch (mErr) { /* listModels best-effort */ }
+                }
+              }
+            }
+          } catch (e) {
+            console.warn('[dsh-moa] ctx.llm.listConfigurableProviders error:', e)
+          }
+        }
+
+        // Query settings for configured providers
+        try {
+          const s = ctx.get ? ctx.get('settings') : ctx.settings
+          const getSetting = (k) => {
+            try { return s?.get?.(k) } catch { return undefined }
+          }
+
+          const def = getSetting('agent-default-model')
+          if (def?.provider && def?.model) {
+            add(def.provider, def.model)
+          }
+
+          const piAi = getSetting('llm-pi-ai')
+          for (const [pName, pData] of Object.entries(piAi?.providers || {})) {
+            for (const m of (pData?.models || [])) {
+              const mId = typeof m === 'string' ? m : (m?.id || m?.model)
+              if (mId) add(pName, mId)
+            }
+          }
+
+          const sync = getSetting('dsh-model-sync')
+          for (const [syncProv, syncModels] of Object.entries(sync?.modelCatalogs || {})) {
+            for (const m of (syncModels || [])) {
+              const mId = typeof m === 'string' ? m : (m?.id || m?.model)
+              if (mId) add(syncProv, mId)
+            }
+          }
+        } catch (e) {
+          console.warn('[dsh-moa] Error reading settings:', e)
+        }
+
+        writeJson(res, 200, { ok: true, models: result })
+      },
+    })
+  }, 'dsh-moa: models route')
+
+  // Route: /dsh-moa/presets
+  ctx.effect(() => {
+    return ctx.webServer.register({
+      kind: 'exact',
+      path: '/dsh-moa/presets',
+      handler: async (req, res) => {
+        const cfg = live()
+        if (req.method === 'GET') {
+          writeJson(res, 200, {
+            ok: true,
+            defaultPreset: cfg.default_preset || 'default',
+            presets: cfg.presets || [],
+          })
+          return
+        }
+
+        if (req.method === 'POST' || req.method === 'PUT') {
+          if (!isSafeWriteRequest(req)) {
+            writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
+            return
+          }
+          try {
+            const raw = await readBody(req)
+            const payload = JSON.parse(raw)
+            const newConfig = {
+              enabled: typeof payload.enabled === 'boolean' ? payload.enabled : cfg.enabled !== false,
+              default_preset: payload.default_preset || cfg.default_preset || 'default',
+              presets: Array.isArray(payload.presets) ? payload.presets : (cfg.presets || []),
+            }
+
+            // Validate the merged payload through the plugin schema before it
+            // reaches the settings storage: malformed payloads must be
+            // rejected with 400 instead of being persisted.
+            let validated
+            try {
+              validated = Config(structuredClone(newConfig))
+            } catch (verr) {
+              writeJson(res, 400, { ok: false, error: 'Invalid presets payload: ' + (verr?.message || String(verr)) })
+              return
+            }
+
+            // Persist via Cordis Settings API
+            if (settingsScope && typeof settingsScope.replace === 'function') {
+              await settingsScope.replace(validated)
+            } else {
+              // In-memory fallback if settings service is unavailable
+              getConfig = () => validated
+            }
+
+            writeJson(res, 200, {
+              ok: true,
+              enabled: validated.enabled !== false,
+              defaultPreset: validated.default_preset,
+              presets: validated.presets,
+            })
+          } catch (err) {
+            writeJson(res, 400, { ok: false, error: err?.message || String(err) })
+          }
+          return
+        }
+
+        writeJson(res, 405, { ok: false, error: 'Method Not Allowed' })
+      },
+    })
+  }, 'dsh-moa: presets route')
+
+  // Route: /dsh-moa/history (#9)
+  ctx.effect(() => {
+    return ctx.webServer.register({
+      kind: 'exact',
+      path: '/dsh-moa/history',
+      handler: async (req, res) => {
+        if (req.method !== 'GET') {
+          writeJson(res, 405, { ok: false, error: 'GET required' })
+          return
+        }
+        try {
+          const u = new URL(req.url, 'http://localhost')
+          const limit = parseInt(u.searchParams.get('limit') || '20', 10)
+          const offset = parseInt(u.searchParams.get('offset') || '0', 10)
+          const data = getMoaHistory(limit, offset)
+          writeJson(res, 200, { ok: true, ...data })
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
+        }
+      },
+    })
+  }, 'dsh-moa: history route')
+
+  // Route: /dsh-moa/leaderboard
+  ctx.effect(() => {
+    return ctx.webServer.register({
+      kind: 'exact',
+      path: '/dsh-moa/leaderboard',
+      handler: async (req, res) => {
+        if (req.method !== 'GET') {
+          writeJson(res, 405, { ok: false, error: 'GET required' })
+          return
+        }
+        try {
+          const url = new URL(req.url || '', 'http://127.0.0.1')
+          const preset = url.searchParams.get('preset') || null
+          const format = url.searchParams.get('format') || 'json'
+
+          if (format === 'csv') {
+            const csv = exportMoaHistory(undefined, { format: 'csv', preset })
+            res.writeHead(200, {
+              'Content-Type': 'text/csv; charset=utf-8',
+              'Content-Disposition': 'attachment; filename="moa-leaderboard.csv"',
+            })
+            res.end(csv)
+            return
+          }
+
+          const data = getMoaLeaderboard(undefined, { preset })
+          writeJson(res, 200, { ok: true, ...data })
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
+        }
+      },
+    })
+  }, 'dsh-moa: leaderboard route')
+
+  // Route: /dsh-moa/promote (Candidate Override Action)
+  ctx.effect(() => {
+    return ctx.webServer.register({
+      kind: 'exact',
+      path: '/dsh-moa/promote',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') {
+          writeJson(res, 405, { ok: false, error: 'POST required' })
+          return
+        }
+        if (!isSafeWriteRequest(req)) {
+          writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
+          return
+        }
+        try {
+          const raw = await readBody(req)
+          const body = JSON.parse(raw || '{}')
+          const candidateIndex = parseInt(body?.candidateIndex, 10)
+          if (isNaN(candidateIndex) || candidateIndex < 1) {
+            writeJson(res, 400, { ok: false, error: 'Valid candidateIndex required (>= 1)' })
+            return
+          }
+          const cwd = body?.cwd || process.cwd()
+          const promotedFiles = await promoteCandidateWorkspace(cwd, candidateIndex, { keepMoa: true })
+          writeJson(res, 200, { ok: true, candidateIndex, promotedFiles })
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
+        }
+      },
+    })
+  }, 'dsh-moa: promote candidate route')
+
+  // Route: /dsh-moa/history/export
+  ctx.effect(() => {
+    return ctx.webServer.register({
+      kind: 'exact',
+      path: '/dsh-moa/history/export',
+      handler: async (req, res) => {
+        if (req.method !== 'GET') {
+          writeJson(res, 405, { ok: false, error: 'GET required' })
+          return
+        }
+        try {
+          const url = new URL(req.url || '', 'http://127.0.0.1')
+          const preset = url.searchParams.get('preset') || null
+          const format = url.searchParams.get('format') || 'json'
+          const data = exportMoaHistory(undefined, { format, preset })
+
+          if (format === 'csv') {
+            res.writeHead(200, {
+              'Content-Type': 'text/csv; charset=utf-8',
+              'Content-Disposition': 'attachment; filename="moa-history.csv"',
+            })
+            res.end(data)
+            return
+          }
+
+          res.writeHead(200, {
+            'Content-Type': 'application/json; charset=utf-8',
+            'Content-Disposition': 'attachment; filename="moa-history.json"',
+          })
+          res.end(data)
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
+        }
+      },
+    })
+  }, 'dsh-moa: history export route')
+
+  // Route: /dsh-moa/runs/<id> (run replay by id)
+  ctx.effect(() => {
+    return ctx.webServer.register({
+      kind: 'prefix',
+      path: '/dsh-moa/runs/',
+      handler: (req, res) => {
+        if (req.method !== 'GET') {
+          writeJson(res, 405, { ok: false, error: 'GET required' })
+          return
+        }
+        const urlPath = req.url.split('?')[0]
+        const parts = urlPath.split('/').filter(Boolean)
+        const runId = parts[2] || ''
+        const run = runId ? getMoaRunById(runId) : null
+        if (!run) {
+          writeJson(res, 404, { ok: false, error: 'Run not found' })
+          return
+        }
+        writeJson(res, 200, { ok: true, run })
+      },
+    })
+  }, 'dsh-moa: run by id route')
+
+  // Route: /dsh-moa/run
+  ctx.effect(() => {
+    return ctx.webServer.register({
+      kind: 'exact',
+      path: '/dsh-moa/run',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') {
+          writeJson(res, 405, { ok: false, error: 'POST required' })
+          return
+        }
+        if (!isSafeWriteRequest(req)) {
+          writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
+          return
+        }
+
+        try {
+          const raw = await readBody(req)
+          const payload = JSON.parse(raw)
+          const prompt = payload.prompt || ''
+          if (!prompt.trim()) {
+            writeJson(res, 400, { ok: false, error: 'Empty prompt' })
+            return
+          }
+
+          const cfg = live()
+          if (cfg.enabled === false) {
+            writeJson(res, 400, { ok: false, error: 'MoA is disabled in settings' })
+            return
+          }
+          const presetName = payload.preset || cfg.default_preset || 'default'
+          const preset = (cfg.presets || []).find((p) => p.name === presetName) || cfg.presets?.[0]
+
+          const result = await runMoAPipeline({
+            userPrompt: prompt,
+            messages: payload.messages || [],
+            preset,
+            callLlm,
+            cwd: payload.cwd || process.cwd(),
+            prices: cfg.prices || {},
+            liveCanvas,
+          })
+
+          if (result?.skippedFiles > 0) {
+            ctx.logger?.warn?.(`[dsh-moa] Workspace scan skipped ${result.skippedFiles} file(s): ${result.skippedList.join(', ')}`)
+          }
+
+          writeJson(res, 200, { ok: true, ...result })
+        } catch (err) {
+          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
+        }
+      },
+    })
+  }, 'dsh-moa: run pipeline route')
+}

package/lib/updater.js

@@ -0,0 +1,282 @@
+// lib/updater.js — Host-side one-click updater for @goodandready/dsh-moa
+// Implements canonical DSH plugin-updater specification.
+
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, resolve } from 'node:path';
+
+const UPDATE_HEADER = 'x-dsh-plugin-update';
+const UPDATE_TIMEOUT_MS = 10 * 60_000;
+const VERSION_CACHE_MS = 5 * 60_000;
+let latestCache;
+
+function header(request, name) {
+  const value = request?.headers?.[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+
+export function isLoopback(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, '');
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address?.startsWith('127.') === true
+    || address?.startsWith('::ffff:127.') === true;
+}
+
+export function isTrustedUpdateRequest(request) {
+  if (header(request, UPDATE_HEADER) !== '1') return false;
+  if (!isLoopback(request.socket?.remoteAddress)) return false;
+  const site = header(request, 'sec-fetch-site');
+  if (site !== undefined && site !== 'same-origin') return false;
+  const origin = header(request, 'origin');
+  const host = header(request, 'host');
+  if (origin === undefined || host === undefined) return false;
+  try {
+    const url = new URL(origin);
+    return (url.protocol === 'http:' || url.protocol === 'https:')
+      && isLoopback(url.hostname) && url.host === host;
+  } catch {
+    return false;
+  }
+}
+
+/** General safe write check for plugin write endpoints (CSRF / Cross-Site protection) */
+export function isSafeWriteRequest(request) {
+  const site = header(request, 'sec-fetch-site');
+  if (site === 'cross-site') return false;
+  const origin = header(request, 'origin');
+  const host = header(request, 'host');
+  if (origin) {
+    try {
+      const url = new URL(origin);
+      if (host && url.host !== host) return false;
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+
+function validProfileName(value) {
+  return typeof value === 'string' && /^[0-9A-Za-z_-]+$/.test(value);
+}
+
+function profileNameFromArgv(argv) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--profile' && index + 1 < argv.length) return argv[index + 1];
+    if (arg.startsWith('--profile=')) return arg.slice('--profile='.length);
+  }
+  return undefined;
+}
+
+function findDshCliEntry() {
+  const entry = process.argv[1];
+  if (typeof entry !== 'string' || entry === '') return undefined;
+  for (let directory = dirname(entry); ; directory = dirname(directory)) {
+    const manifestPath = resolve(directory, 'package.json');
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        const bin = typeof manifest.bin === 'string'
+          ? manifest.bin
+          : typeof manifest.bin === 'object' && manifest.bin !== null
+            ? manifest.bin.dsh
+            : undefined;
+        if (manifest.name === '@deepseek-ai/dsh' && typeof bin === 'string'
+          && !isAbsolute(bin) && resolve(directory, bin) === resolve(entry)) return entry;
+      } catch {
+        // Continue searching parent package directories.
+      }
+    }
+    const parent = dirname(directory);
+    if (parent === directory) return undefined;
+  }
+}
+
+function runtime() {
+  const profileDir = resolve(process.env.DSH_PROFILE_DIR
+    ?? resolve(homedir(), '.dsh', 'profiles', 'web'));
+  const selected = profileNameFromArgv(process.argv);
+  const profileName = validProfileName(selected)
+    ? selected
+    : validProfileName(basename(profileDir)) ? basename(profileDir) : 'web';
+  const cliEntry = findDshCliEntry();
+  return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry };
+}
+
+function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  if (match === null) return undefined;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split('.') ?? [],
+  };
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index];
+    const b = right[index];
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1;
+    if (a === b) continue;
+    const aNumeric = /^\d+$/.test(a);
+    const bNumeric = /^\d+$/.test(b);
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a);
+      const bNumber = BigInt(b);
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1;
+      continue;
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+    return a > b ? 1 : -1;
+  }
+  return 0;
+}
+
+export function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue);
+  const candidate = parseSemver(candidateValue);
+  if (current === undefined || candidate === undefined) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index];
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0;
+}
+
+async function latestVersion(packageName, registry) {
+  if (latestCache?.packageName === packageName && latestCache.registry === registry && Date.now() < latestCache.expiresAt) return latestCache.version;
+  try {
+    const response = await fetch(`${registry.replace(/\/$/, '')}/${encodeURIComponent(packageName)}/latest`, {
+      signal: AbortSignal.timeout(8_000),
+    });
+    if (!response.ok) return undefined;
+    const value = await response.json();
+    if (typeof value.version !== 'string' || value.version === '') return undefined;
+    latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS };
+    return value.version;
+  } catch {
+    return undefined;
+  }
+}
+
+async function currentVersion(manifestUrl) {
+  const value = JSON.parse(await readFile(manifestUrl, 'utf8'));
+  if (typeof value.version !== 'string' || value.version === '') throw new Error('Cannot read current plugin version.');
+  return value.version;
+}
+
+export async function getUpdateStatus(options, target = runtime()) {
+  const current = await currentVersion(options.manifestUrl);
+  const latest = await latestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org');
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...(latest === undefined ? {} : { latestVersion: latest }),
+    latestCheckFailed: latest === undefined,
+    updateAvailable: latest !== undefined && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.cliEntry !== undefined,
+  };
+}
+
+async function installExact(target, packageSpec, options) {
+  if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.');
+  await new Promise((resolvePromise, reject) => {
+    // Note: Respect strict ecosystem quarantine policy without age bypass
+    const args = [
+      target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
+      packageSpec,
+      `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+    ];
+    const child = spawn(process.execPath, args, {
+      cwd: target.profileDir,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, NO_COLOR: '1' },
+    });
+    let detail = '';
+    child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
+    child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
+    const timer = setTimeout(() => {
+      child.kill();
+      reject(new Error('Update timed out; use the normal DSH update flow.'));
+    }, UPDATE_TIMEOUT_MS);
+    child.once('error', error => { clearTimeout(timer); reject(error); });
+    child.once('exit', code => {
+      clearTimeout(timer);
+      if (code === 0) resolvePromise();
+      else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`));
+    });
+  });
+}
+
+function json(response, statusCode, value) {
+  response.writeHead(statusCode, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+  });
+  response.end(JSON.stringify(value));
+}
+
+export function registerPluginUpdater(ctx, options) {
+  const host = ctx;
+  let installing = false;
+  return host.webServer.register({
+    kind: 'exact',
+    path: options.endpoint,
+    handler: async (request, response) => {
+      try {
+        const target = runtime();
+        if (request.method === 'GET' || request.method === 'HEAD') {
+          const payload = await getUpdateStatus(options, target);
+          response.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          });
+          response.end(request.method === 'HEAD' ? undefined : JSON.stringify(payload));
+          return;
+        }
+        if (request.method !== 'POST') {
+          response.writeHead(405, { allow: 'GET, HEAD, POST' });
+          response.end();
+          return;
+        }
+        if (!isTrustedUpdateRequest(request)) {
+          json(response, 403, { error: 'Rejected non-local or cross-origin update request.' });
+          return;
+        }
+        if (installing) {
+          json(response, 409, { error: 'This plugin is already updating.' });
+          return;
+        }
+        installing = true;
+        try {
+          const before = await getUpdateStatus(options, target);
+          if (before.latestVersion === undefined) {
+            json(response, 503, { error: 'The latest version is temporarily unavailable.' });
+            return;
+          }
+          if (!before.updateAvailable) {
+            json(response, 200, before);
+            return;
+          }
+          await installExact(target, `${options.packageName}@${before.latestVersion}`, options);
+          json(response, 200, {
+            ...before,
+            updatedVersion: before.latestVersion,
+            restartRequired: true,
+          });
+        } finally {
+          installing = false;
+        }
+      } catch (error) {
+        ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`);
+        json(response, 503, { error: 'Plugin update failed; see server logs.' });
+      }
+    },
+  });
+}