@goodandready/dsh-moa 0.2.20 → 0.2.21

package/lib/client.js

@@ -1954,6 +1954,20 @@ window.__ModuleLoader__.load({
         reload()
       }, [reload])
 
+      React.useEffect(() => {
+        const lbUrl = leaderboardPresetFilter !== 'all'
+          ? `/dsh-moa/leaderboard?preset=${encodeURIComponent(leaderboardPresetFilter)}`
+          : '/dsh-moa/leaderboard'
+        fetch(lbUrl, { cache: 'no-store' })
+          .then((r) => r.json())
+          .then((data) => {
+            if (data && data.ok && Array.isArray(data.models)) {
+              setLeaderboard(data.models.slice(0, 10))
+            }
+          })
+          .catch(() => {})
+      }, [leaderboardPresetFilter])
+
       const handleSave = () => {
         setSaveStatus(t('actions.saving'))
 

package/lib/file-workspace.js

@@ -3,15 +3,31 @@ import vm from 'node:vm'
 import fs from 'node:fs/promises'
 import path from 'node:path'
 
+/**
+ * Validates that an untrusted relative path is safe and does not traverse upwards.
+ */
+export function isSafeRelativePath(relPath) {
+  if (!relPath || typeof relPath !== 'string') return false
+  const trimmed = relPath.trim()
+  if (!trimmed || path.isAbsolute(trimmed) || trimmed.startsWith('/') || trimmed.startsWith('\\')) return false
+  const normalized = path.normalize(trimmed)
+  return Boolean(normalized && !normalized.startsWith('..') && !path.isAbsolute(normalized))
+}
+
+/**
+ * Asserts that a resolved path is strictly contained within baseDir.
+ */
+export function assertPathContained(baseDir, subPath) {
+  const resolvedBase = path.resolve(baseDir)
+  const resolvedTarget = path.resolve(resolvedBase, subPath)
+  if (resolvedTarget !== resolvedBase && !resolvedTarget.startsWith(resolvedBase + path.sep)) {
+    throw new Error(`Path traversal violation: "${subPath}" escapes base directory "${baseDir}"`)
+  }
+  return resolvedTarget
+}
+
 /**
  * Parses markdown code blocks that specify file paths.
- * Supports patterns like:
- * ```html file="index.html"
- * ```javascript filepath=script.js
- * // File: index.html
- * <!-- File: styles.css -->
- * ### File: index.html
- * ```html
  */
 export function extractFileBlocks(text) {
   if (!text || typeof text !== 'string') return []
@@ -19,81 +35,48 @@ export function extractFileBlocks(text) {
   const files = []
   const seenPaths = new Set()
 
-  // Pattern 1: fenced blocks with file="..." or path="..." in info string
-  // Example: ```html file="index.html" or ```js path=src/main.js
-  const fenceRegex = /```[\w-]*\s+(?:file|path|filepath)=["']?([^\s"'\n\r]+)["']?[\r\n]+([\s\S]*?)```/gi
-  let match
-  while ((match = fenceRegex.exec(text)) !== null) {
-    const rawPath = match[1].trim()
-    const content = match[2]
-    if (rawPath && !seenPaths.has(rawPath)) {
+  const addFile = (rawPath, fileContent) => {
+    if (rawPath && isSafeRelativePath(rawPath) && !seenPaths.has(rawPath)) {
       seenPaths.add(rawPath)
-      files.push({ relativePath: sanitizePath(rawPath), content })
+      files.push({ relativePath: rawPath, content: fileContent.trimEnd() + '\n' })
     }
   }
 
-  // Pattern 2: Explicit headers before code blocks, e.g.
-  // **File: `index.html`** or ### File: index.html or `File: index.html` followed by ```
-  const headerRegex = /(?:###?\s*File:\s*|File:\s*|#\s*File:\s*)[`"]?([a-zA-Z0-9_.\-\/\\]+)[`"]?\s*[\r\n]+```[\w-]*[\r\n]+([\s\S]*?)```/gi
-  while ((match = headerRegex.exec(text)) !== null) {
-    const rawPath = match[1].trim()
-    const content = match[2]
-    if (rawPath && !seenPaths.has(rawPath)) {
-      seenPaths.add(rawPath)
-      files.push({ relativePath: sanitizePath(rawPath), content })
-    }
-  }
+  // Pattern 1: fenced blocks with file="..." or path="..." in info string
+  const fenceRegex = /```[\w-]*\s+(?:file|path|filepath)=["']?([^\s"'\n\r]+)["']?[\r\n]+([\s\S]*?)```/gi
+  let match
+  while ((match = fenceRegex.exec(text)) !== null) addFile(match[1].trim(), match[2])
 
-  // Pattern 3: Comment inside the code block on line 1: // File: foo.js or /* File: foo.css */ or <!-- File: index.html -->
-  const commentRegex = /```[\w-]*[\r\n]+(?:\/\/|\/\*|<!--|#)\s*(?:File|filename):\s*([a-zA-Z0-9_.\-\/\\]+)(?:\s*\*\/|\s*-->)?[\r\n]+([\s\S]*?)```/gi
-  while ((match = commentRegex.exec(text)) !== null) {
-    const rawPath = match[1].trim()
-    const content = match[2]
-    if (rawPath && !seenPaths.has(rawPath)) {
-      seenPaths.add(rawPath)
-      files.push({ relativePath: sanitizePath(rawPath), content })
-    }
-  }
+  // Pattern 2: comment header: // File: path/to/file.ext or <!-- File: ... -->
+  const commentRegex = /(?:\/\/|#|<!--)\s*(?:File|Path):\s*([^\s\n\r>]+)(?:\s*-->)?[\r\n]+```[\w-]*[\r\n]+([\s\S]*?)```/gi
+  while ((match = commentRegex.exec(text)) !== null) addFile(match[1].trim(), match[2])
+
+  // Pattern 3: markdown header: ### File: path/to/file.ext
+  const headerRegex = /#{1,4}\s+(?:File|Path):\s*([^\s\n\r]+)[\r\n]+```[\w-]*[\r\n]+([\s\S]*?)```/gi
+  while ((match = headerRegex.exec(text)) !== null) addFile(match[1].trim(), match[2])
 
-  // Fallback: If no annotated blocks found, check if text has exactly one prominent standalone code block with common extensions
+  // Pattern 4: first line inside code block: // File: path/to/file.ext
+  const inlineRegex = /```[\w-]*[\r\n]+(?:\/\/|#|<!--)\s*(?:File|Path):\s*([^\s\n\r>]+)(?:\s*-->)?[\r\n]+([\s\S]*?)```/gi
+  while ((match = inlineRegex.exec(text)) !== null) addFile(match[1].trim(), match[2])
+
+  // Fallback: single anonymous code block if it contains complete HTML
   if (files.length === 0) {
-    const singleBlockRegex = /```(html|css|javascript|js|json|python|py|sh|bash)[\r\n]+([\s\S]*?)```/gi
-    const singleMatches = []
-    while ((match = singleBlockRegex.exec(text)) !== null) {
-      singleMatches.push({ lang: match[1].toLowerCase(), content: match[2] })
-    }
-    if (singleMatches.length === 1) {
-      const extMap = {
-        html: 'index.html',
-        javascript: 'index.js',
-        js: 'index.js',
-        css: 'style.css',
-        python: 'main.py',
-        py: 'main.py',
-        json: 'data.json',
-        bash: 'run.sh',
-        sh: 'run.sh',
+    const htmlBlockRegex = /```(?:html)?[\r\n]+([\s\S]*?)```/gi
+    let htmlMatch
+    while ((htmlMatch = htmlBlockRegex.exec(text)) !== null) {
+      const candidateHtml = htmlMatch[1]
+      if (/<(!DOCTYPE\s+)?html/i.test(candidateHtml) || /<body/i.test(candidateHtml)) {
+        files.push({ relativePath: 'index.html', content: candidateHtml.trimEnd() + '\n' })
+        break
       }
-      const defaultName = extMap[singleMatches[0].lang] || 'output.txt'
-      files.push({ relativePath: defaultName, content: singleMatches[0].content })
     }
   }
 
   return files
 }
 
-function sanitizePath(filePath) {
-  const normalized = path.normalize(filePath).replace(/^(\.\.[\/\\])+/, '')
-  return normalized.replace(/^[\\\/]+/, '')
-}
-
-/**
- * Collects readable text files from current workspace to feed as context for candidate models (#6).
- * Ignores node_modules, .git, .moa, binary files, large bundles.
- */
 /**
- * Formats collected project files into structured Markdown code blocks
- * suitable for inclusion in candidate system prompts.
+ * Formats collected project files into a structured markdown context string.
  */
 export function formatProjectContext(projectFiles = [], options = {}) {
   if (!Array.isArray(projectFiles) || projectFiles.length === 0) return ''
@@ -123,7 +106,6 @@ export async function collectProjectContext(baseDir, maxCharBudget = 16000) {
 
   const collected = []
   let totalChars = 0
-
   let skippedFiles = 0
   const skippedList = []
 
@@ -132,17 +114,14 @@ export async function collectProjectContext(baseDir, maxCharBudget = 16000) {
     let list
     try {
       list = await fs.readdir(currentDir, { withFileTypes: true })
-    } catch (readDirErr) {
+    } catch {
       skippedFiles++
       skippedList.push(relPrefix || '.')
       return
     }
 
     for (const item of list) {
-      // Skip all dotfiles, including .env and .env.* variants: their
-      // contents must never be shipped to third-party model providers.
       if (item.name.startsWith('.')) continue
-
       const rel = relPrefix ? `${relPrefix}/${item.name}` : item.name
       const full = path.join(currentDir, item.name)
 
@@ -155,9 +134,7 @@ export async function collectProjectContext(baseDir, maxCharBudget = 16000) {
       }
 
       if (item.isDirectory()) {
-        if (!ignoreDirs.has(item.name)) {
-          await scan(full, rel)
-        }
+        if (!ignoreDirs.has(item.name)) await scan(full, rel)
       } else if (item.isFile()) {
         const ext = path.extname(item.name).toLowerCase()
         if (codeExts.has(ext)) {
@@ -173,7 +150,7 @@ export async function collectProjectContext(baseDir, maxCharBudget = 16000) {
             const truncated = content.length > budgetRemaining ? content.slice(0, budgetRemaining) + '\n... [truncated]' : content
             totalChars += truncated.length
             collected.push({ relativePath: rel, content: truncated, size: stat.size })
-          } catch (fileErr) {
+          } catch {
             skippedFiles++
             skippedList.push(rel)
           }
@@ -187,8 +164,7 @@ export async function collectProjectContext(baseDir, maxCharBudget = 16000) {
 }
 
 /**
- * Checks if a task prompt is an iterative refinement / modification
- * of an existing project rather than a greenfield project creation (#4).
+ * Checks if a task prompt is an iterative refinement / modification.
  */
 export function isRefinementTask(userPrompt = '', projectFiles = null) {
   if (Array.isArray(projectFiles) && projectFiles.length === 0) return false
@@ -226,13 +202,16 @@ export async function writeCandidateWorkspace(baseDir, candidateIndex, files = [
   if (!baseDir || !Array.isArray(files) || files.length === 0) return []
 
   const targetStr = String(candidateIndex).trim()
-  const sub = /^\d+$/.test(targetStr) ? `candidate-${targetStr}` : targetStr
-  const candidateDir = path.join(baseDir, '.moa', sub)
+  const sanitizedTarget = targetStr.replace(/[^a-zA-Z0-9_-]/g, '')
+  const sub = /^\d+$/.test(sanitizedTarget) ? `candidate-${sanitizedTarget}` : (sanitizedTarget || 'candidate-1')
+  const moaRoot = path.join(baseDir, '.moa')
+  const candidateDir = assertPathContained(moaRoot, sub)
   await fs.mkdir(candidateDir, { recursive: true })
 
   const written = []
   for (const file of files) {
-    const fullPath = path.join(candidateDir, file.relativePath)
+    if (!isSafeRelativePath(file.relativePath)) continue
+    const fullPath = assertPathContained(candidateDir, file.relativePath)
     await fs.mkdir(path.dirname(fullPath), { recursive: true })
     await fs.writeFile(fullPath, file.content, 'utf8')
     written.push({
@@ -245,10 +224,6 @@ export async function writeCandidateWorkspace(baseDir, candidateIndex, files = [
   return written
 }
 
-/**
- * Promotes winning candidate files to baseDir root,
- * then cleans up the temporary .moa folder.
- */
 /**
  * Best-effort integration with dsh-time-machine to create a shadow Git checkpoint
  * before candidate promotion overwrites files in the project workspace.
@@ -267,14 +242,8 @@ export async function createPrePromotionCheckpoint(baseDir, candidateTarget, opt
   const snap = await bestEffort('dsh-time-machine pre-promotion checkpoint', async () => {
     const res = await fetch(endpoint, {
       method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'x-dsh-trusted': '1',
-      },
-      body: JSON.stringify({
-        label,
-        cwd: baseDir,
-      }),
+      headers: { 'Content-Type': 'application/json', 'x-dsh-trusted': '1' },
+      body: JSON.stringify({ label, cwd: baseDir }),
       signal: AbortSignal.timeout(options.timeoutMs ?? 1500),
     })
     if (res.ok) {
@@ -290,9 +259,10 @@ export async function promoteCandidateWorkspace(baseDir, winningIndex, options =
   if (!baseDir || winningIndex === null || winningIndex === undefined) return []
 
   const targetStr = String(winningIndex).trim()
-  const sub = /^\d+$/.test(targetStr) ? `candidate-${targetStr}` : targetStr
-  const winningDir = path.join(baseDir, '.moa', sub)
+  const sanitizedTarget = targetStr.replace(/[^a-zA-Z0-9_-]/g, '')
+  const sub = /^\d+$/.test(sanitizedTarget) ? `candidate-${sanitizedTarget}` : (sanitizedTarget || 'candidate-1')
   const moaRoot = path.join(baseDir, '.moa')
+  const winningDir = assertPathContained(moaRoot, sub)
 
   try {
     const entries = await getFilesRecursively(winningDir)
@@ -303,27 +273,21 @@ export async function promoteCandidateWorkspace(baseDir, winningIndex, options =
       return []
     }
 
-    // Best-effort Time Machine checkpoint before overwriting files in baseDir
     const checkpoint = await createPrePromotionCheckpoint(baseDir, winningIndex, options)
 
     const promoted = []
     for (const rel of entries) {
-      const srcPath = path.join(winningDir, rel)
-      const destPath = path.join(baseDir, rel)
+      if (!isSafeRelativePath(rel)) continue
+      const srcPath = assertPathContained(winningDir, rel)
+      const destPath = assertPathContained(baseDir, rel)
 
       await fs.mkdir(path.dirname(destPath), { recursive: true })
       await fs.copyFile(srcPath, destPath)
       promoted.push(rel)
     }
 
-    if (checkpoint) {
-      promoted.checkpoint = checkpoint
-    }
-
-    if (!options.keepMoa) {
-      // Clean up temporary .moa folder
-      await fs.rm(moaRoot, { recursive: true, force: true })
-    }
+    if (checkpoint) promoted.checkpoint = checkpoint
+    if (!options.keepMoa) await fs.rm(moaRoot, { recursive: true, force: true })
 
     return promoted
   } catch (err) {
@@ -348,7 +312,7 @@ async function getFilesRecursively(dir) {
   try {
     const stat = await fs.stat(dir)
     if (!stat.isDirectory()) return []
-  } catch (statErr) {
+  } catch {
     return []
   }
 
@@ -359,13 +323,10 @@ async function getFilesRecursively(dir) {
       for (const item of list) {
         const rel = relPrefix ? `${relPrefix}/${item.name}` : item.name
         const full = path.join(current, item.name)
-        if (item.isDirectory()) {
-          await scan(full, rel)
-        } else if (item.isFile()) {
-          results.push(rel)
-        }
+        if (item.isDirectory()) await scan(full, rel)
+        else if (item.isFile()) results.push(rel)
       }
-    } catch (readErr) {
+    } catch {
       return
     }
   }
@@ -373,10 +334,8 @@ async function getFilesRecursively(dir) {
   return results
 }
 
-
 /**
  * Verifies the syntactic validity of generated code files.
- * Uses Node.js in-memory vm.Script for JS (with ES module export/import transformation) and JSON.parse for JSON.
  */
 export function verifyFileSyntax(files = []) {
   if (!Array.isArray(files)) return []
@@ -424,33 +383,43 @@ export function verifyFileSyntax(files = []) {
 export async function readCandidateFiles(baseDir, candidateTarget) {
   if (!baseDir || candidateTarget === undefined || candidateTarget === null) return []
   const targetStr = String(candidateTarget).trim()
-  const sub = /^\d+$/.test(targetStr) ? `candidate-${targetStr}` : targetStr
-  const targetDir = path.join(baseDir, '.moa', sub)
+  const sanitizedTarget = targetStr.replace(/[^a-zA-Z0-9_-]/g, '')
+  const sub = /^\d+$/.test(sanitizedTarget) ? `candidate-${sanitizedTarget}` : (sanitizedTarget || 'candidate-1')
+  const moaRoot = path.join(baseDir, '.moa')
+
+  let targetDir
+  try {
+    targetDir = assertPathContained(moaRoot, sub)
+  } catch {
+    return []
+  }
 
   try {
     const relFiles = await getFilesRecursively(targetDir)
     const result = []
     for (const rel of relFiles) {
+      if (!isSafeRelativePath(rel)) continue
       try {
-        const fullPath = path.join(targetDir, rel)
+        const fullPath = assertPathContained(targetDir, rel)
         const content = await fs.readFile(fullPath, 'utf8')
         result.push({
           relativePath: rel,
           content,
           size: Buffer.byteLength(content, 'utf8'),
         })
-      } catch (readErr) {
+      } catch {
         // file read error best-effort
       }
     }
     return result
-  } catch (err) {
+  } catch {
     return []
   }
 }
 
 /**
- * Computes a standard line-by-line diff between two text strings using LCS.
+ * Computes a line-by-line diff between two text strings using LCS with
+ * common prefix and suffix trimming for optimal O(delta) performance.
  * Returns an array of diff items: { type: 'same' | 'added' | 'removed', line: string, oldNum?: number, newNum?: number }
  */
 export function computeLineDiff(oldText = '', newText = '') {
@@ -460,44 +429,97 @@ export function computeLineDiff(oldText = '', newText = '') {
   const n = oldLines.length
   const m = newLines.length
 
-  // Safety bound to avoid polynomial blowup on enormous files
-  if (n > 2000 || m > 2000) {
-    const res = []
-    for (let i = 0; i < n; i++) res.push({ type: 'removed', line: oldLines[i], oldNum: i + 1 })
-    for (let j = 0; j < m; j++) res.push({ type: 'added', line: newLines[j], newNum: j + 1 })
-    return res
+  if (n === 0 && m === 0) return []
+  if (oldText === newText) {
+    return oldLines.map((line, idx) => ({
+      type: 'same',
+      line,
+      oldNum: idx + 1,
+      newNum: idx + 1,
+    }))
+  }
+
+  // 1. Trim common prefix
+  let start = 0
+  while (start < n && start < m && oldLines[start] === newLines[start]) {
+    start++
   }
 
-  // DP table for LCS
-  const dp = Array.from({ length: n + 1 }, () => new Uint16Array(m + 1))
-  for (let i = 0; i < n; i++) {
-    for (let j = 0; j < m; j++) {
-      if (oldLines[i] === newLines[j]) {
-        dp[i + 1][j + 1] = dp[i][j] + 1
-      } else {
-        dp[i + 1][j + 1] = Math.max(dp[i + 1][j], dp[i][j + 1])
+  // 2. Trim common suffix
+  let oldEnd = n - 1
+  let newEnd = m - 1
+  while (oldEnd >= start && newEnd >= start && oldLines[oldEnd] === newLines[newEnd]) {
+    oldEnd--
+    newEnd--
+  }
+
+  const prefixItems = []
+  for (let k = 0; k < start; k++) {
+    prefixItems.push({ type: 'same', line: oldLines[k], oldNum: k + 1, newNum: k + 1 })
+  }
+
+  const suffixItems = []
+  const suffixLen = (n - 1) - oldEnd
+  for (let k = 0; k < suffixLen; k++) {
+    const oNum = oldEnd + 1 + k + 1
+    const nNum = newEnd + 1 + k + 1
+    suffixItems.push({ type: 'same', line: oldLines[oldEnd + 1 + k], oldNum: oNum, newNum: nNum })
+  }
+
+  const subOld = oldLines.slice(start, oldEnd + 1)
+  const subNew = newLines.slice(start, newEnd + 1)
+  const subN = subOld.length
+  const subM = subNew.length
+
+  const middleItems = []
+
+  if (subN === 0) {
+    for (let j = 0; j < subM; j++) {
+      middleItems.push({ type: 'added', line: subNew[j], newNum: start + j + 1 })
+    }
+  } else if (subM === 0) {
+    for (let i = 0; i < subN; i++) {
+      middleItems.push({ type: 'removed', line: subOld[i], oldNum: start + i + 1 })
+    }
+  } else if (subN > 2000 || subM > 2000) {
+    for (let i = 0; i < subN; i++) {
+      middleItems.push({ type: 'removed', line: subOld[i], oldNum: start + i + 1 })
+    }
+    for (let j = 0; j < subM; j++) {
+      middleItems.push({ type: 'added', line: subNew[j], newNum: start + j + 1 })
+    }
+  } else {
+    const dp = Array.from({ length: subN + 1 }, () => new Uint16Array(subM + 1))
+    for (let i = 0; i < subN; i++) {
+      for (let j = 0; j < subM; j++) {
+        if (subOld[i] === subNew[j]) {
+          dp[i + 1][j + 1] = dp[i][j] + 1
+        } else {
+          dp[i + 1][j + 1] = Math.max(dp[i + 1][j], dp[i][j + 1])
+        }
       }
     }
-  }
 
-  // Backtrack
-  let i = n
-  let j = m
-  const stack = []
-
-  while (i > 0 || j > 0) {
-    if (i > 0 && j > 0 && oldLines[i - 1] === newLines[j - 1]) {
-      stack.push({ type: 'same', line: oldLines[i - 1], oldNum: i, newNum: j })
-      i--
-      j--
-    } else if (j > 0 && (i === 0 || dp[i][j - 1] >= dp[i - 1][j])) {
-      stack.push({ type: 'added', line: newLines[j - 1], newNum: j })
-      j--
-    } else if (i > 0 && (j === 0 || dp[i][j - 1] < dp[i - 1][j])) {
-      stack.push({ type: 'removed', line: oldLines[i - 1], oldNum: i })
-      i--
+    let i = subN
+    let j = subM
+    const stack = []
+
+    while (i > 0 || j > 0) {
+      if (i > 0 && j > 0 && subOld[i - 1] === subNew[j - 1]) {
+        stack.push({ type: 'same', line: subOld[i - 1], oldNum: start + i, newNum: start + j })
+        i--
+        j--
+      } else if (j > 0 && (i === 0 || dp[i][j - 1] >= dp[i - 1][j])) {
+        stack.push({ type: 'added', line: subNew[j - 1], newNum: start + j })
+        j--
+      } else if (i > 0 && (j === 0 || dp[i][j - 1] < dp[i - 1][j])) {
+        stack.push({ type: 'removed', line: subOld[i - 1], oldNum: start + i })
+        i--
+      }
     }
+
+    middleItems.push(...stack.reverse())
   }
 
-  return stack.reverse()
+  return [...prefixItems, ...middleItems, ...suffixItems]
 }

package/lib/history.js

@@ -15,6 +15,13 @@ const DEFAULT_HISTORY_FILE = path.join(DEFAULT_HISTORY_DIR, 'moa-history.jsonl')
 /** Max history file size before rotation (10 MB) */
 export const MAX_HISTORY_BYTES = 10 * 1024 * 1024
 
+/** In-memory cache for leaderboard and parsed analytics */
+let _historyCache = null
+
+export function invalidateHistoryCache() {
+  _historyCache = null
+}
+
 function getHistoryFilePath(customDir) {
   if (customDir) {
     return path.join(customDir, '.moa-history.jsonl')
@@ -36,6 +43,7 @@ export function rotateHistoryFileIfNeeded(filePath = DEFAULT_HISTORY_FILE, maxBy
         try { fs.unlinkSync(backupPath) } catch (unlinkErr) { /* backup unlink best-effort */ }
       }
       fs.renameSync(filePath, backupPath)
+      invalidateHistoryCache()
       return true
     }
   } catch (err) {
@@ -97,6 +105,7 @@ export function recordMoaRun(record, filePath = DEFAULT_HISTORY_FILE) {
     const entry = normalizeRunRecord(record)
     const line = JSON.stringify(entry) + '\n'
     fs.appendFileSync(filePath, line, 'utf8')
+    invalidateHistoryCache()
     return entry
   } catch (err) {
     console.warn('[dsh-moa] Failed to record run to history:', err)
@@ -117,6 +126,7 @@ export async function recordMoaRunAsync(record, filePath = DEFAULT_HISTORY_FILE)
     const entry = normalizeRunRecord(record)
     const line = JSON.stringify(entry) + '\n'
     await fs.promises.appendFile(filePath, line, 'utf8')
+    invalidateHistoryCache()
     return entry
   } catch (err) {
     console.warn('[dsh-moa] Failed to async-record run to history:', err)
@@ -124,6 +134,49 @@ export async function recordMoaRunAsync(record, filePath = DEFAULT_HISTORY_FILE)
   }
 }
 
+/**
+ * Reads lines from the end of a file in reverse order in chunks.
+ * Avoids loading multi-megabyte JSONL files into V8 heap strings.
+ */
+export function readTailLinesSync(filePath, countNeeded = 50) {
+  const CHUNK_SIZE = 64 * 1024
+  const fd = fs.openSync(filePath, 'r')
+  try {
+    const stat = fs.fstatSync(fd)
+    let pos = stat.size
+    let remainder = ''
+    const collectedLines = []
+
+    while (pos > 0 && collectedLines.length < countNeeded) {
+      const bytesToRead = Math.min(CHUNK_SIZE, pos)
+      pos -= bytesToRead
+      const buf = Buffer.alloc(bytesToRead)
+      fs.readSync(fd, buf, 0, bytesToRead, pos)
+      const chunkStr = buf.toString('utf8') + remainder
+      const lines = chunkStr.split('\n')
+      if (pos > 0) {
+        remainder = lines.shift()
+      } else {
+        remainder = ''
+      }
+
+      for (let i = lines.length - 1; i >= 0; i--) {
+        const trimmed = lines[i].trim()
+        if (trimmed) {
+          collectedLines.push(trimmed)
+          if (collectedLines.length >= countNeeded) break
+        }
+      }
+    }
+    if (remainder && remainder.trim() && collectedLines.length < countNeeded) {
+      collectedLines.push(remainder.trim())
+    }
+    return collectedLines
+  } finally {
+    fs.closeSync(fd)
+  }
+}
+
 /**
  * Reads history runs with pagination (latest first).
  */
@@ -133,13 +186,34 @@ export function getMoaHistory(limit = 20, offset = 0, filePath = DEFAULT_HISTORY
       return { total: 0, runs: [] }
     }
 
-    const raw = fs.readFileSync(filePath, 'utf8')
-    const lines = raw.trim().split('\n').filter(Boolean)
-    const total = lines.length
+    const stat = fs.statSync(filePath)
+    const needed = offset + limit
+
+    // For files under 64KB, straightforward full-read is fast and keeps exact total
+    if (stat.size <= 65536) {
+      const raw = fs.readFileSync(filePath, 'utf8')
+      const lines = raw.trim().split('\n').filter(Boolean)
+      const total = lines.length
+
+      const sliced = lines
+        .slice(Math.max(0, total - offset - limit), total - offset)
+        .reverse()
+        .map((line) => {
+          try {
+            return JSON.parse(line)
+          } catch {
+            return null
+          }
+        })
+        .filter(Boolean)
+
+      return { total, runs: sliced }
+    }
 
-    const sliced = lines
-      .slice(Math.max(0, total - offset - limit), total - offset)
-      .reverse()
+    // For larger files: read only tail lines backwards to avoid splitting 10MB in memory
+    const tailLines = readTailLinesSync(filePath, needed)
+    const pageLines = tailLines.slice(offset, offset + limit)
+    const runs = pageLines
       .map((line) => {
         try {
           return JSON.parse(line)
@@ -149,7 +223,12 @@ export function getMoaHistory(limit = 20, offset = 0, filePath = DEFAULT_HISTORY
       })
       .filter(Boolean)
 
-    return { total, runs: sliced }
+    let total = _historyCache?.totalCount
+    if (typeof total !== 'number') {
+      total = tailLines.length >= needed ? Math.max(tailLines.length, Math.round(stat.size / 250)) : tailLines.length
+    }
+
+    return { total, runs }
   } catch (err) {
     console.warn('[dsh-moa] Failed to read history:', err)
     return { total: 0, runs: [] }
@@ -158,6 +237,7 @@ export function getMoaHistory(limit = 20, offset = 0, filePath = DEFAULT_HISTORY
 
 /**
  * Calculates win-rate leaderboard and model performance statistics across history.
+ * Employs in-memory caching keyed by file mtime and size for O(1) repeated queries.
  */
 export function getMoaLeaderboard(filePath = DEFAULT_HISTORY_FILE, options = {}) {
   try {
@@ -165,13 +245,35 @@ export function getMoaLeaderboard(filePath = DEFAULT_HISTORY_FILE, options = {})
       return { totalRuns: 0, models: [] }
     }
 
+    const stat = fs.statSync(filePath)
+    const presetFilter = typeof options === 'string' ? options : (options?.presetFilter || options?.preset || null)
+    const filterKey = presetFilter || 'all'
+
+    if (
+      _historyCache &&
+      _historyCache.filePath === filePath &&
+      _historyCache.mtimeMs === stat.mtimeMs &&
+      _historyCache.size === stat.size
+    ) {
+      if (_historyCache.leaderboards.has(filterKey)) {
+        return _historyCache.leaderboards.get(filterKey)
+      }
+    } else {
+      _historyCache = {
+        filePath,
+        mtimeMs: stat.mtimeMs,
+        size: stat.size,
+        leaderboards: new Map(),
+        totalCount: null,
+      }
+    }
+
     const raw = fs.readFileSync(filePath, 'utf8')
     const lines = raw.trim().split('\n').filter(Boolean)
     const totalRuns = lines.length
+    _historyCache.totalCount = totalRuns
 
     const modelStats = new Map()
-    const presetFilter = typeof options === 'string' ? options : (options?.presetFilter || options?.preset || null)
-
     let filteredRuns = 0
     for (const line of lines) {
       try {
@@ -198,6 +300,7 @@ export function getMoaLeaderboard(filePath = DEFAULT_HISTORY_FILE, options = {})
             }
             const st = modelStats.get(key)
             st.runs += 1
+
             const inTok = cand.usage?.inputTokens || 0
             const outTok = cand.usage?.outputTokens || 0
             st.totalTokens += inTok + outTok
@@ -222,7 +325,13 @@ export function getMoaLeaderboard(filePath = DEFAULT_HISTORY_FILE, options = {})
       }))
       .sort((a, b) => b.wins - a.wins || b.winRate - a.winRate)
 
-    return { totalRuns: presetFilter && presetFilter !== 'all' ? filteredRuns : totalRuns, models, preset: presetFilter }
+    const result = {
+      totalRuns: presetFilter && presetFilter !== 'all' ? filteredRuns : totalRuns,
+      models,
+      preset: presetFilter,
+    }
+    _historyCache.leaderboards.set(filterKey, result)
+    return result
   } catch (err) {
     console.warn('[dsh-moa] Failed to calculate leaderboard:', err)
     return { totalRuns: 0, models: [] }

package/lib/moa-candidates.js

@@ -104,7 +104,12 @@ export async function runReferencesParallel(references, messages, options = {},
         )
 
         const timeoutPromise = new Promise((_, reject) => {
-          const timer = setTimeout(() => reject(new Error(`Timeout after ${Math.round(timeoutMs / 1000)}s`)), timeoutMs)
+          const timer = setTimeout(() => {
+            bestEffort('candidate timeout abort', () => {
+              abortControllers[i].abort(new Error(`Timeout after ${Math.round(timeoutMs / 1000)}s`))
+            })
+            reject(new Error(`Timeout after ${Math.round(timeoutMs / 1000)}s`))
+          }, timeoutMs)
           timer.unref?.()
           abortControllers[i].signal.addEventListener('abort', () => clearTimeout(timer), { once: true })
         })

package/lib/routes.js

@@ -8,10 +8,13 @@ import {
   getMoaRunById,
   exportMoaHistory,
 } from './history.js'
-import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff } from './file-workspace.js'
+import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff, isSafeRelativePath } from './file-workspace.js'
 import { isSafeWriteRequest } from './updater.js'
 import { runMoAPipeline } from './moa-runner.js'
 
+let _modelsCache = { timestamp: 0, models: [] }
+const MODELS_CACHE_TTL = 60 * 1000
+
 function writeJson(res, status, body) {
   res.writeHead(status, {
     'Content-Type': 'application/json; charset=utf-8',
@@ -60,6 +63,11 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/models',
       handler: async (_req, res) => {
+        if (_modelsCache.models.length > 0 && Date.now() - _modelsCache.timestamp < MODELS_CACHE_TTL) {
+          writeJson(res, 200, { ok: true, models: _modelsCache.models, cached: true })
+          return
+        }
+
         const result = []
         const seen = new Set()
 
@@ -87,18 +95,23 @@ ctx.effect(() => {
           try {
             if (typeof ctx.llm.listConfigurableProviders === 'function') {
               const cProvs = ctx.llm.listConfigurableProviders() || []
-              for (const cp of cProvs) {
+              const queries = cProvs.map(async (cp) => {
                 const cpId = cp.provider || cp.id
-                if (cpId && typeof ctx.llm.listModels === 'function') {
-                  try {
-                    const mList = await ctx.llm.listModels(cpId)
-                    for (const m of (mList || [])) {
-                      const mId = typeof m === 'string' ? m : (m.id || m.model || m.name)
-                      if (mId) add(cpId, mId)
-                    }
-                  } catch (mErr) { /* listModels best-effort */ }
+                if (!cpId || typeof ctx.llm.listModels !== 'function') return
+                try {
+                  const mList = await Promise.race([
+                    ctx.llm.listModels(cpId),
+                    new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 2000)),
+                  ])
+                  for (const m of (mList || [])) {
+                    const mId = typeof m === 'string' ? m : (m?.id || m?.model || m?.name)
+                    if (mId) add(cpId, mId)
+                  }
+                } catch {
+                  /* provider query timeout or error handled best-effort */
                 }
-              }
+              })
+              await Promise.allSettled(queries)
             }
           } catch (e) {
             console.warn('[dsh-moa] ctx.llm.listConfigurableProviders error:', e)
@@ -136,6 +149,7 @@ ctx.effect(() => {
           console.warn('[dsh-moa] Error reading settings:', e)
         }
 
+        _modelsCache = { timestamp: Date.now(), models: result }
         writeJson(res, 200, { ok: true, models: result })
       },
     })
@@ -309,9 +323,14 @@ ctx.effect(() => {
         try {
           const u = new URL(req.url, 'http://localhost')
           const cwd = u.searchParams.get('cwd') || process.cwd()
-          const from = u.searchParams.get('from') || '1'
-          const to = u.searchParams.get('to') || 'curator-synthesis'
-          const file = u.searchParams.get('file') || ''
+          const sanitizeTarget = (val, def) => {
+            const clean = String(val || '').trim().replace(/[^a-zA-Z0-9_-]/g, '')
+            return clean || def
+          }
+          const from = sanitizeTarget(u.searchParams.get('from'), '1')
+          const to = sanitizeTarget(u.searchParams.get('to'), 'curator-synthesis')
+          const rawFile = u.searchParams.get('file') || ''
+          const file = (rawFile && isSafeRelativePath(rawFile)) ? rawFile : ''
 
           const fromFiles = await readCandidateFiles(cwd, from)
           const toFiles = await readCandidateFiles(cwd, to)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",