@goodandready/dsh-moa 0.2.27 → 0.2.29

package/lib/file-workspace.js

@@ -11,7 +11,8 @@ export function isSafeRelativePath(relPath) {
   const trimmed = relPath.trim()
   if (!trimmed || path.isAbsolute(trimmed) || trimmed.startsWith('/') || trimmed.startsWith('\\')) return false
   const normalized = path.normalize(trimmed)
-  return Boolean(normalized && !normalized.startsWith('..') && !path.isAbsolute(normalized))
+  if (!normalized || normalized === '.' || normalized.startsWith('..') || path.isAbsolute(normalized)) return false
+  return true
 }
 
 /**
@@ -150,9 +151,9 @@ export async function collectProjectContext(baseDir, maxCharBudget = 16000) {
             const truncated = content.length > budgetRemaining ? content.slice(0, budgetRemaining) + '\n... [truncated]' : content
             totalChars += truncated.length
             collected.push({ relativePath: rel, content: truncated, size: stat.size })
-          } catch {
+          } catch (err) {
             skippedFiles++
-            skippedList.push(rel)
+            skippedList.push(`${rel} (read error: ${err?.message || String(err)})`)
           }
         }
       }
@@ -294,7 +295,7 @@ export async function promoteCandidateWorkspace(baseDir, winningIndex, options =
     if (!options.keepMoa) {
       await bestEffort('clean moaRoot on promote error', () => fs.rm(moaRoot, { recursive: true, force: true }))
     }
-    return []
+    throw err
   }
 }
 

package/lib/history.js

@@ -1,3 +1,4 @@
+import { logger } from './logger.js'
 /**
  * MoA Run History & Analytics Module
  * Records every MoA pipeline execution, tracks model win rates and costs,
@@ -47,7 +48,7 @@ export function rotateHistoryFileIfNeeded(filePath = DEFAULT_HISTORY_FILE, maxBy
       return true
     }
   } catch (err) {
-    console.warn('[dsh-moa] History rotation warning:', err?.message || err)
+    logger.warn('[dsh-moa] History rotation warning:', err?.message || err)
   }
   return false
 }
@@ -110,7 +111,7 @@ export function recordMoaRun(record, filePath = DEFAULT_HISTORY_FILE) {
     invalidateHistoryCache()
     return entry
   } catch (err) {
-    console.warn('[dsh-moa] Failed to record run to history:', err)
+    logger.warn('[dsh-moa] Failed to record run to history:', err)
     return null
   }
 }
@@ -131,7 +132,7 @@ export async function recordMoaRunAsync(record, filePath = DEFAULT_HISTORY_FILE)
     invalidateHistoryCache()
     return entry
   } catch (err) {
-    console.warn('[dsh-moa] Failed to async-record run to history:', err)
+    logger.warn('[dsh-moa] Failed to async-record run to history:', err)
     return null
   }
 }
@@ -232,7 +233,7 @@ export function getMoaHistory(limit = 20, offset = 0, filePath = DEFAULT_HISTORY
 
     return { total, runs }
   } catch (err) {
-    console.warn('[dsh-moa] Failed to read history:', err)
+    logger.warn('[dsh-moa] Failed to read history:', err)
     return { total: 0, runs: [] }
   }
 }
@@ -335,7 +336,7 @@ export function getMoaLeaderboard(filePath = DEFAULT_HISTORY_FILE, options = {})
     _historyCache.leaderboards.set(filterKey, result)
     return result
   } catch (err) {
-    console.warn('[dsh-moa] Failed to calculate leaderboard:', err)
+    logger.warn('[dsh-moa] Failed to calculate leaderboard:', err)
     return { totalRuns: 0, models: [] }
   }
 }
@@ -405,7 +406,7 @@ export function exportMoaHistory(filePath = DEFAULT_HISTORY_FILE, options = {})
 
     return JSON.stringify(records, null, 2)
   } catch (err) {
-    console.warn('[dsh-moa] Failed to export history:', err)
+    logger.warn('[dsh-moa] Failed to export history:', err)
     return options?.format === 'csv' ? '' : '[]'
   }
 }

package/lib/index.js

@@ -1,3 +1,4 @@
+import { setLogger, logger } from './logger.js'
 import { refreshCatalogInBackground } from './pricing.js'
 /**
  * DeepSeek Harness Mixture of Agents (MoA) Plugin
@@ -163,6 +164,7 @@ export function plainConfig(value) {
 }
 
 export function apply(ctx, config) {
+  if (ctx.logger) setLogger(ctx.logger)
   refreshCatalogInBackground()
 
   let localConfig = plainConfig(config ?? {})
@@ -209,7 +211,7 @@ export function apply(ctx, config) {
         await settingsService.update(NS, plain)
       }
     } catch (err) {
-      console.warn('[dsh-moa] Settings persistence warning:', err?.message || err)
+      logger.warn('[dsh-moa] Settings persistence warning:', err?.message || err)
     }
     return localConfig
   }

package/lib/logger.js

@@ -0,0 +1,40 @@
+/**
+ * Context logger abstraction for dsh-moa.
+ * Avoids raw direct console warnings in server-side modules and respects Cordis ctx.logger.
+ */
+let currentLogger = null
+
+export function setLogger(logger) {
+  currentLogger = logger
+}
+
+export const logger = {
+  warn(...args) {
+    if (currentLogger && typeof currentLogger.warn === 'function') {
+      currentLogger.warn(...args)
+    } else if (typeof console !== 'undefined' && typeof console.debug === 'function') {
+      console.debug(...args)
+    }
+  },
+  debug(...args) {
+    if (currentLogger && typeof currentLogger.debug === 'function') {
+      currentLogger.debug(...args)
+    } else if (typeof console !== 'undefined' && typeof console.debug === 'function') {
+      console.debug(...args)
+    }
+  },
+  info(...args) {
+    if (currentLogger && typeof currentLogger.info === 'function') {
+      currentLogger.info(...args)
+    } else if (typeof console !== 'undefined' && typeof console.debug === 'function') {
+      console.debug(...args)
+    }
+  },
+  error(...args) {
+    if (currentLogger && typeof currentLogger.error === 'function') {
+      currentLogger.error(...args)
+    } else if (typeof console !== 'undefined' && typeof console.debug === 'function') {
+      console.debug(...args)
+    }
+  },
+}

package/lib/moa-candidates.js

@@ -1,3 +1,4 @@
+import { logger } from './logger.js'
 /**
  * DeepSeek Harness Mixture of Agents (MoA) — Candidate Fan-Out & Retry
  * With Per-Candidate Temperature, Temperature Gradient & Local Fallback Resilience
@@ -200,7 +201,7 @@ export async function runReferencesParallel(references, messages, options = {},
               }
               break
             } catch (fbErr) {
-              console.warn(`[dsh-moa] Fallback ${fbLabel} also failed:`, fbErr?.message || fbErr)
+              logger.warn(`[dsh-moa] Fallback ${fbLabel} also failed:`, fbErr?.message || fbErr)
             }
           }
         }
@@ -208,7 +209,7 @@ export async function runReferencesParallel(references, messages, options = {},
         if (!fallbackRecovered) {
           finishedCount++
           const errMsg = err?.message || String(err)
-          console.warn(`[dsh-moa] Reference ${label} failed:`, errMsg)
+          logger.warn(`[dsh-moa] Reference ${label} failed:`, errMsg)
           if (typeof onProgress === 'function') {
             onProgress(`⚠️ *Candidate ${i + 1}/${total} (${label}) error: ${errMsg}*\n`)
           }

package/lib/moa-runner.js

@@ -1,9 +1,10 @@
+import { logger } from './logger.js'
 import path from 'node:path'
 import crypto from 'node:crypto'
 import { bestEffort } from './best-effort.js'
 import { extractFileBlocks, collectProjectContext, formatProjectContext, isRefinementTask, writeCandidateWorkspace, promoteCandidateWorkspace, cleanMoaWorkspaces, verifyFileSyntax } from './file-workspace.js'
 import { estimateTokenCost, summarizeMoAUsage } from './pricing.js'
-import { recordMoaRun, candidatesForHistory } from './history.js'
+import { recordMoaRunAsync, candidatesForHistory } from './history.js'
 import { createPromotedPreview } from './live-canvas.js'
 import { slotLabel, cleanAdvisoryMessages, isBroadPromptRequiringQuestions, buildQuestionSynthesisPrompt, buildCuratorSynthesisPrompt, buildSynthesisPrompt, buildPeerCritiquePrompt, ROLE_PERSONA_PROMPTS, SYSTEM_ROLE_PROPOSER, ANTIPATTERNS_RUBRIC } from './moa-prompts.js'
 import { parseWinnerIndex, parseRecommendedAssembler, parseMoACommand, stripOrSummarizeCode, formatMoAResponse } from './moa-parser.js'
@@ -227,7 +228,7 @@ export async function runMoAPipeline({
       }
       qUsage = estimateTokenCost(primaryJudge, qFallbackUsage, prices)
     } catch (err) {
-      console.warn('[dsh-moa] Questionnaire synthesis failed, proceeding with fallback questions:', err)
+      logger.warn('[dsh-moa] Questionnaire synthesis failed, proceeding with fallback questions:', err)
       questionsContent = `### Clarification of Requirements: "${userPrompt}"\n\n1. **Architecture & Scope**: Single-file deliverable or multi-module project structure?\n2. **Design & Style**: Minimalist, dark mode, or clean neutral theme?\n3. **Functional Priorities**: Core MVP or comprehensive extended implementation?\n\n*Reply with your preferences (e.g. "1, 2") or proceed with defaults.*`
     }
 
@@ -237,7 +238,7 @@ export async function runMoAPipeline({
     const durationMs = Date.now() - startTime
 
     try {
-      recordMoaRun({
+      await recordMoaRunAsync({
         prompt: userPrompt,
         preset: preset?.name || 'default',
         isRefinement,
@@ -251,7 +252,7 @@ export async function runMoAPipeline({
         durationMs,
       }, historyFilePath || undefined)
     } catch (histErr) {
-      console.warn('[dsh-moa] Failed to record questionnaire run in history:', histErr?.message || histErr)
+      logger.warn('[dsh-moa] Failed to record questionnaire run in history:', histErr?.message || histErr)
     }
 
     return {
@@ -293,7 +294,7 @@ export async function runMoAPipeline({
     const durationMs = Date.now() - startTime
 
     try {
-      recordMoaRun({
+      await recordMoaRunAsync({
         prompt: userPrompt,
         preset: preset?.name || 'default',
         isRefinement,
@@ -308,7 +309,7 @@ export async function runMoAPipeline({
         durationMs,
       }, historyFilePath || undefined)
     } catch (histErr) {
-      console.warn('[dsh-moa] Failed to record fast synthesis run in history:', histErr?.message || histErr)
+      logger.warn('[dsh-moa] Failed to record fast synthesis run in history:', histErr?.message || histErr)
     }
 
     return {
@@ -376,7 +377,7 @@ export async function runMoAPipeline({
           cand.costUsd = Number(((cand.costUsd || 0) + extraCost.costUsd).toFixed(5))
         }
       } catch (r2CostErr) {
-        console.warn('[dsh-moa] Failed to estimate Round 2 cost:', r2CostErr?.message || r2CostErr)
+        logger.warn('[dsh-moa] Failed to estimate Round 2 cost:', r2CostErr?.message || r2CostErr)
       }
     })
     await Promise.allSettled(r2Promises)
@@ -460,7 +461,7 @@ export async function runMoAPipeline({
       break
     } catch (err) {
       lastJudgeError = err
-      console.warn(`[dsh-moa] Judge ${currentLabel} failed:`, err)
+      logger.warn(`[dsh-moa] Judge ${currentLabel} failed:`, err)
       if (typeof onProgress === 'function') {
         const nextJudge = judgesChain[jIdx + 1]
         const nextHint = nextJudge ? ` Trying fallback ${slotLabel(nextJudge)}...` : ''
@@ -529,7 +530,7 @@ export async function runMoAPipeline({
   }
 
   try {
-    recordMoaRun({
+    await recordMoaRunAsync({
       id: runId,
       prompt: userPrompt,
       preset: preset?.name || 'default',
@@ -546,7 +547,7 @@ export async function runMoAPipeline({
       durationMs,
     }, historyFilePath || undefined)
   } catch (histErr) {
-    console.warn('[dsh-moa] Failed to record run in history:', histErr)
+    logger.warn('[dsh-moa] Failed to record run in history:', histErr)
   }
 
   return {

package/lib/moa-test-gate.js

@@ -4,6 +4,7 @@ import fsSync from 'node:fs'
 import path from 'node:path'
 import { spawn } from 'node:child_process'
 import { assertPathContained } from './file-workspace.js'
+import { bestEffort } from './best-effort.js'
 
 /**
  * Resolves the directory for candidate sandbox.
@@ -179,9 +180,9 @@ export async function runCandidateTestGate({
     }
   } finally {
     if (stageDir) {
-      try {
-        await fs.rm(stageDir, { recursive: true, force: true })
-      } catch {}
+      await bestEffort('moa-test-gate cleanup stageDir', () =>
+        fs.rm(stageDir, { recursive: true, force: true })
+      )
     }
   }
 }

package/lib/routes.js

@@ -46,7 +46,11 @@ ctx.effect(() => {
     return ctx.webServer.register({
       kind: 'exact',
       path: '/dsh-moa/status',
-      handler: (_req, res) => {
+      handler: (req, res) => {
+        if (req.method !== 'GET') {
+          writeJson(res, 405, { ok: false, error: 'GET required' })
+          return
+        }
         try {
           const cfg = live()
           writeJson(res, 200, {
@@ -67,7 +71,11 @@ ctx.effect(() => {
     return ctx.webServer.register({
       kind: 'exact',
       path: '/dsh-moa/models',
-      handler: async (_req, res) => {
+      handler: async (req, res) => {
+        if (req.method !== 'GET') {
+          writeJson(res, 405, { ok: false, error: 'GET required' })
+          return
+        }
         if (_modelsCache.models.length > 0 && Date.now() - _modelsCache.timestamp < MODELS_CACHE_TTL) {
           writeJson(res, 200, { ok: true, models: _modelsCache.models, cached: true })
           return
@@ -94,7 +102,7 @@ ctx.effect(() => {
               }
             }
           } catch (e) {
-            console.warn('[dsh-moa] ctx.llm.listAvailableModels error:', e)
+            ctx.logger?.warn?.('[dsh-moa] ctx.llm.listAvailableModels error:', e)
           }
 
           try {
@@ -119,7 +127,7 @@ ctx.effect(() => {
               await Promise.allSettled(queries)
             }
           } catch (e) {
-            console.warn('[dsh-moa] ctx.llm.listConfigurableProviders error:', e)
+            ctx.logger?.warn?.('[dsh-moa] ctx.llm.listConfigurableProviders error:', e)
           }
         }
 
@@ -156,7 +164,7 @@ ctx.effect(() => {
             }
           }
         } catch (e) {
-          console.warn('[dsh-moa] Error reading settings:', e)
+          ctx.logger?.warn?.('[dsh-moa] Error reading settings:', e)
         }
 
         _modelsCache = { timestamp: Date.now(), models: result }
@@ -241,8 +249,10 @@ ctx.effect(() => {
         }
         try {
           const u = new URL(req.url, 'http://localhost')
-          const limit = parseInt(u.searchParams.get('limit') || '20', 10)
-          const offset = parseInt(u.searchParams.get('offset') || '0', 10)
+          const rawLimit = parseInt(u.searchParams.get('limit') || '20', 10)
+          const rawOffset = parseInt(u.searchParams.get('offset') || '0', 10)
+          const limit = Math.max(1, Math.min(100, Number.isFinite(rawLimit) ? rawLimit : 20))
+          const offset = Math.max(0, Number.isFinite(rawOffset) ? rawOffset : 0)
           const data = getMoaHistory(limit, offset)
           writeJson(res, 200, { ok: true, ...data })
         } catch (err) {
@@ -470,18 +480,26 @@ ctx.effect(() => {
           writeJson(res, 405, { ok: false, error: 'POST required' })
           return
         }
+        if (!isSafeWriteRequest(req)) {
+          writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
+          return
+        }
         try {
+          const cfg = live()
+          if (cfg.enabled === false) {
+            writeJson(res, 400, { ok: false, error: 'MoA is disabled in settings' })
+            return
+          }
           const raw = await readBody(req)
           const body = JSON.parse(raw || '{}')
           const prompt = body?.prompt || ''
-          const cfg = live()
           const result = await resolvePresetForPrompt({
             prompt,
             presets: cfg.presets || [],
             defaultPreset: cfg.default_preset || 'default',
             routingModel: cfg.smart_routing_model,
             callLlm,
-            enabled: true,
+            enabled: cfg.enabled !== false,
           })
           writeJson(res, 200, { ok: true, ...result })
         } catch (err) {
@@ -491,6 +509,9 @@ ctx.effect(() => {
     })
   }, 'dsh-moa: route preset endpoint')
 
+  let _lastRunTimestamp = 0
+  const RUN_MIN_INTERVAL_MS = 1000
+
   // Route: /dsh-moa/run
   ctx.effect(() => {
     return ctx.webServer.register({
@@ -505,6 +526,12 @@ ctx.effect(() => {
           writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
           return
         }
+        const now = Date.now()
+        if (now - _lastRunTimestamp < RUN_MIN_INTERVAL_MS) {
+          writeJson(res, 429, { ok: false, error: 'Rate limit exceeded: please wait before starting another run' })
+          return
+        }
+        _lastRunTimestamp = now
 
         try {
           const raw = await readBody(req)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.27",
+  "version": "0.2.29",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",