@goodandready/dsh-moa 0.2.27 → 0.2.30

package/README.md

@@ -151,8 +151,8 @@ When `multi_judge_enabled: true`, candidate solutions are independently evaluate
 ### 11. Composite Hybrid Synthesis (AST / Block Merge)
 When `composite_merge_enabled: true`, the aggregator assembles a modular hybrid: combining the strongest core logic from one model, robust error handling from another, and complete types/tests from a third.
 
-### 12. Smart Dynamic Preset Router & JEV Classifier
-When invoking `/moa` without explicit preset flags, the router classifies prompt intent using keyword heuristics or a zero-shot JEV model (`smart_routing_model`) to automatically select the optimal preset.
+### 12. Smart Dynamic Preset Router & LLM Classifier
+When invoking `/moa` without explicit preset flags, the router classifies prompt intent using keyword heuristics or a zero-shot router model (`smart_routing_model`) to automatically select the optimal preset.
 
 ### 13. Real-Time Live Cost Counter & Streaming Ticker
 As each candidate completes, live token counts and USD costs are streamed directly into the chat based on catalog pricing and vendor rates.
@@ -195,16 +195,16 @@ v0.2.13 introduces 10 ready-to-use presets engineered for real-world software wo
 
 | Preset Name | Purpose | Default Aggregator | Peer Critique | Blind Eval |
 | :--- | :--- | :--- | :---: | :---: |
-| `default` | Balanced multi-model generation | `codex:gpt-5.6-sol` | Optional | Off |
-| `code-review` | Thorough peer review & vulnerability detection | `codex:gpt-5.6-sol` | On | On |
-| `fast-audit` | Ultra-fast single-model audit (Fast Mode) | `codex:gpt-5.6-sol` | Off | Off |
-| `deep-architect` | Distributed systems & complex architectures | `codex:gpt-5.6-sol` | On | Off |
-| `bug-hunter` | Root cause discovery & adversarial edge cases | `codex:gpt-5.6-sol` | On | Off |
-| `refactor-cleanup` | Dead-code pruning & standard-library simplicity | `codex:gpt-5.6-sol` | Off | Off |
-| `frontend-ui` | High-fidelity responsive web interfaces | `codex:gpt-5.6-sol` | Off | Off |
-| `security-audit` | Zero-trust threat analysis & sanitization | `codex:gpt-5.6-sol` | On | On |
-| `math-logic` | Deterministic algorithmic proofs & math logic | `codex:gpt-5.6-sol` | On | Off |
-| `creative-brainstorm`| Divergent lateral thinking & ideation | `codex:gpt-5.6-sol` | Off | Off |
+| `default` | Balanced multi-model generation | `<provider>:<model>` | Optional | Off |
+| `code-review` | Thorough peer review & vulnerability detection | `<provider>:<model>` | On | On |
+| `fast-audit` | Ultra-fast single-model audit (Fast Mode) | `<provider>:<model>` | Off | Off |
+| `deep-architect` | Distributed systems & complex architectures | `<provider>:<model>` | On | Off |
+| `bug-hunter` | Root cause discovery & adversarial edge cases | `<provider>:<model>` | On | Off |
+| `refactor-cleanup` | Dead-code pruning & standard-library simplicity | `<provider>:<model>` | Off | Off |
+| `frontend-ui` | High-fidelity responsive web interfaces | `<provider>:<model>` | Off | Off |
+| `security-audit` | Zero-trust threat analysis & sanitization | `<provider>:<model>` | On | On |
+| `math-logic` | Deterministic algorithmic proofs & math logic | `<provider>:<model>` | On | Off |
+| `creative-brainstorm`| Divergent lateral thinking & ideation | `<provider>:<model>` | Off | Off |
 
 ### Candidate Personas (`role_persona`)
 Assign archetypal engineering mentalities to individual candidate slots to ensure genuine perspective divergence:

package/README.ru.md

@@ -151,8 +151,8 @@ graph TD
 ### 11. Композитный гибридный синтез (Composite AST/Block Merge)
 Опция `composite_merge_enabled` активирует алгоритм объединения модулей: судья не просто выбирает одного кандидата, а синтезирует итоговое решение из лучших компонентов всех участников (чистейшая алгоритмическая база от одного, надежные обработчики ошибок от второго, исчерпывающие типы и тесты от третьего).
 
-### 12. Умный динамический роутинг пресетов и модель JEV
-При запуске `/moa` без явного указания флага встроенный классификатор определяет намерение (интерфейсы, безопасность, рефакторинг, баги, архитектура) по эвристическим правилам или с помощью легковесной модели JEV (`smart_routing_model`) и автоматически подбирает оптимальный пресет.
+### 12. Умный динамический роутинг пресетов и модель роутера
+При запуске `/moa` без явного указания флага встроенный классификатор определяет намерение (интерфейсы, безопасность, рефакторинг, баги, архитектура) по эвристическим правилам или с помощью легковесной модели роутера (`smart_routing_model`) и автоматически подбирает оптимальный пресет.
 
 ### 13. Живой счетчик стоимости и потоковая телеметрия
 По мере завершения каждого кандидата плагин в реальном времени транслирует в чат накопленный расход токенов и расчетную стоимость в USD на базе встроенного каталога тарифов OpenRouter и прямых цен провайдеров.
@@ -195,16 +195,16 @@ dsh plugin --profile web add @goodandready/dsh-moa
 
 | Имя пресета | Назначение | Судья по умолчанию | Рецензия (Round 2) | Слепая оценка |
 | :--- | :--- | :--- | :---: | :---: |
-| `default` | Сбалансированная генерация | `codex:gpt-5.6-sol` | Опционально | Выкл |
-| `code-review` | Глубокое взаимное ревью кода | `codex:gpt-5.6-sol` | Вкл | Вкл |
-| `fast-audit` | Сверхбыстрый экспресс-аудит (Fast Mode) | `codex:gpt-5.6-sol` | Выкл | Выкл |
-| `deep-architect` | Проектирование распределенных систем | `codex:gpt-5.6-sol` | Вкл | Выкл |
-| `bug-hunter` | Поиск скрытых багов и граничных случаев | `codex:gpt-5.6-sol` | Вкл | Выкл |
-| `refactor-cleanup` | Чистка легаси и удаление оверинжиниринга | `codex:gpt-5.6-sol` | Выкл | Выкл |
-| `frontend-ui` | Качественные адаптивные веб-интерфейсы | `codex:gpt-5.6-sol` | Выкл | Выкл |
-| `security-audit` | Анализ уязвимостей и санитайзинг | `codex:gpt-5.6-sol` | Вкл | Вкл |
-| `math-logic` | Алгоритмы, математическая логика и доказательства | `codex:gpt-5.6-sol` | Вкл | Выкл |
-| `creative-brainstorm`| Нестандартные идеи и дивергентный поиск | `codex:gpt-5.6-sol` | Выкл | Выкл |
+| `default` | Сбалансированная генерация | `<provider>:<model>` | Опционально | Выкл |
+| `code-review` | Глубокое взаимное ревью кода | `<provider>:<model>` | Вкл | Вкл |
+| `fast-audit` | Сверхбыстрый экспресс-аудит (Fast Mode) | `<provider>:<model>` | Выкл | Выкл |
+| `deep-architect` | Проектирование распределенных систем | `<provider>:<model>` | Вкл | Выкл |
+| `bug-hunter` | Поиск скрытых багов и граничных случаев | `<provider>:<model>` | Вкл | Выкл |
+| `refactor-cleanup` | Чистка легаси и удаление оверинжиниринга | `<provider>:<model>` | Выкл | Выкл |
+| `frontend-ui` | Качественные адаптивные веб-интерфейсы | `<provider>:<model>` | Выкл | Выкл |
+| `security-audit` | Анализ уязвимостей и санитайзинг | `<provider>:<model>` | Вкл | Вкл |
+| `math-logic` | Алгоритмы, математическая логика и доказательства | `<provider>:<model>` | Вкл | Выкл |
+| `creative-brainstorm`| Нестандартные идеи и дивергентный поиск | `<provider>:<model>` | Выкл | Выкл |
 
 ### Инженерные персоны кандидатов (`role_persona`)
 Задавайте кандидатам четкие роли для максимального разнообразия подходов:

package/lib/file-workspace.js

@@ -1,4 +1,5 @@
 import { bestEffort } from './best-effort.js'
+import { logger } from './logger.js'
 import vm from 'node:vm'
 import fs from 'node:fs/promises'
 import path from 'node:path'
@@ -11,7 +12,8 @@ export function isSafeRelativePath(relPath) {
   const trimmed = relPath.trim()
   if (!trimmed || path.isAbsolute(trimmed) || trimmed.startsWith('/') || trimmed.startsWith('\\')) return false
   const normalized = path.normalize(trimmed)
-  return Boolean(normalized && !normalized.startsWith('..') && !path.isAbsolute(normalized))
+  if (!normalized || normalized === '.' || normalized.startsWith('..') || path.isAbsolute(normalized)) return false
+  return true
 }
 
 /**
@@ -150,9 +152,9 @@ export async function collectProjectContext(baseDir, maxCharBudget = 16000) {
             const truncated = content.length > budgetRemaining ? content.slice(0, budgetRemaining) + '\n... [truncated]' : content
             totalChars += truncated.length
             collected.push({ relativePath: rel, content: truncated, size: stat.size })
-          } catch {
+          } catch (err) {
             skippedFiles++
-            skippedList.push(rel)
+            skippedList.push(`${rel} (read error: ${err?.message || String(err)})`)
           }
         }
       }
@@ -236,13 +238,28 @@ export async function createPrePromotionCheckpoint(baseDir, candidateTarget, opt
   }
 
   const label = options.checkpointLabel || `moa-pre-promotion: candidate-${candidateTarget}`
-  const port = options.port || process.env.DSH_PORT || process.env.PORT || 3000
+
+  // 1. Direct Cordis timeMachineEngine service call if available
+  if (options.timeMachineEngine && typeof options.timeMachineEngine.createSnapshot === 'function') {
+    const snap = await bestEffort('dsh-time-machine direct service createSnapshot', async () => {
+      return await options.timeMachineEngine.createSnapshot(label, { cwd: baseDir })
+    })
+    if (snap) return snap
+  }
+
+  // 2. HTTP endpoint call if port or timeMachineUrl is provided
+  const port = options.port || options.webServerPort || process.env.DSH_PORT || process.env.PORT
+  if (!port && !options.timeMachineUrl) {
+    logger.warn('[dsh-moa] Cannot create pre-promotion checkpoint: webServerPort is unknown and no timeMachineUrl provided')
+    return null
+  }
+
   const endpoint = options.timeMachineUrl || `http://127.0.0.1:${port}/dsh-time-machine/create`
 
   const snap = await bestEffort('dsh-time-machine pre-promotion checkpoint', async () => {
     const res = await fetch(endpoint, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'x-dsh-trusted': '1' },
+      headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ label, cwd: baseDir }),
       signal: AbortSignal.timeout(options.timeoutMs ?? 1500),
     })
@@ -274,6 +291,11 @@ export async function promoteCandidateWorkspace(baseDir, winningIndex, options =
     }
 
     const checkpoint = await createPrePromotionCheckpoint(baseDir, winningIndex, options)
+    if (options.checkpoint !== false && !checkpoint && !options.force) {
+      const errMsg = `[dsh-moa] Pre-promotion checkpoint failed for candidate-${winningIndex} in ${baseDir}. File overwrite blocked to prevent uncheckpointed changes (pass force: true to override).`
+      logger.warn(errMsg)
+      throw new Error(errMsg)
+    }
 
     const promoted = []
     for (const rel of entries) {
@@ -294,7 +316,7 @@ export async function promoteCandidateWorkspace(baseDir, winningIndex, options =
     if (!options.keepMoa) {
       await bestEffort('clean moaRoot on promote error', () => fs.rm(moaRoot, { recursive: true, force: true }))
     }
-    return []
+    throw err
   }
 }
 

package/lib/history.js

@@ -1,3 +1,4 @@
+import { logger } from './logger.js'
 /**
  * MoA Run History & Analytics Module
  * Records every MoA pipeline execution, tracks model win rates and costs,
@@ -9,8 +10,38 @@ import path from 'node:path'
 import os from 'node:os'
 import crypto from 'node:crypto'
 
-const DEFAULT_HISTORY_DIR = path.join(os.homedir(), '.dsh')
-const DEFAULT_HISTORY_FILE = path.join(DEFAULT_HISTORY_DIR, 'moa-history.jsonl')
+export function isTestEnvironment() {
+  return (
+    process.env.NODE_ENV === 'test' ||
+    process.env.DSH_TEST === '1' ||
+    Boolean(process.env.NODE_TEST_CONTEXT) ||
+    Boolean(process.execArgv?.some((arg) => arg.includes('test'))) ||
+    Boolean(process.argv?.[1]?.includes('test'))
+  )
+}
+
+export function getDefaultHistoryDir() {
+  if (process.env.DSH_HISTORY_DIR) {
+    return process.env.DSH_HISTORY_DIR
+  }
+  if (process.env.DSH_HOME) {
+    return path.join(process.env.DSH_HOME, '.dsh')
+  }
+  if (isTestEnvironment()) {
+    return path.join(os.tmpdir(), '.dsh-test')
+  }
+  return path.join(os.homedir(), '.dsh')
+}
+
+export function getDefaultHistoryFile() {
+  if (process.env.DSH_HISTORY_FILE) {
+    return process.env.DSH_HISTORY_FILE
+  }
+  return path.join(getDefaultHistoryDir(), 'moa-history.jsonl')
+}
+
+export const DEFAULT_HISTORY_DIR = getDefaultHistoryDir()
+export const DEFAULT_HISTORY_FILE = getDefaultHistoryFile()
 
 /** Max history file size before rotation (10 MB) */
 export const MAX_HISTORY_BYTES = 10 * 1024 * 1024
@@ -22,18 +53,18 @@ export function invalidateHistoryCache() {
   _historyCache = null
 }
 
-function getHistoryFilePath(customDir) {
+export function getHistoryFilePath(customDir) {
   if (customDir) {
     return path.join(customDir, '.moa-history.jsonl')
   }
-  return DEFAULT_HISTORY_FILE
+  return getDefaultHistoryFile()
 }
 
 /**
  * Checks if the history file exceeds the size threshold and rotates it.
  * Moves current file to `${filePath}.1`, removing any older `.1` backup.
  */
-export function rotateHistoryFileIfNeeded(filePath = DEFAULT_HISTORY_FILE, maxBytes = MAX_HISTORY_BYTES) {
+export function rotateHistoryFileIfNeeded(filePath = getDefaultHistoryFile(), maxBytes = MAX_HISTORY_BYTES) {
   try {
     if (!fs.existsSync(filePath)) return false
     const stat = fs.statSync(filePath)
@@ -47,7 +78,7 @@ export function rotateHistoryFileIfNeeded(filePath = DEFAULT_HISTORY_FILE, maxBy
       return true
     }
   } catch (err) {
-    console.warn('[dsh-moa] History rotation warning:', err?.message || err)
+    logger.warn('[dsh-moa] History rotation warning:', err?.message || err)
   }
   return false
 }
@@ -95,7 +126,7 @@ function normalizeRunRecord(record) {
  * Appends a completed MoA run record to the history file synchronously (preserves sync API).
  * Performs automatic size-based rotation.
  */
-export function recordMoaRun(record, filePath = DEFAULT_HISTORY_FILE) {
+export function recordMoaRun(record, filePath = getDefaultHistoryFile()) {
   try {
     const dir = path.dirname(filePath)
     if (!fs.existsSync(dir)) {
@@ -110,7 +141,7 @@ export function recordMoaRun(record, filePath = DEFAULT_HISTORY_FILE) {
     invalidateHistoryCache()
     return entry
   } catch (err) {
-    console.warn('[dsh-moa] Failed to record run to history:', err)
+    logger.warn('[dsh-moa] Failed to record run to history:', err)
     return null
   }
 }
@@ -118,7 +149,7 @@ export function recordMoaRun(record, filePath = DEFAULT_HISTORY_FILE) {
 /**
  * Asynchronously appends a completed MoA run record without blocking the event loop.
  */
-export async function recordMoaRunAsync(record, filePath = DEFAULT_HISTORY_FILE) {
+export async function recordMoaRunAsync(record, filePath = getDefaultHistoryFile()) {
   try {
     const dir = path.dirname(filePath)
     await fs.promises.mkdir(dir, { recursive: true }).catch(() => {})
@@ -131,7 +162,7 @@ export async function recordMoaRunAsync(record, filePath = DEFAULT_HISTORY_FILE)
     invalidateHistoryCache()
     return entry
   } catch (err) {
-    console.warn('[dsh-moa] Failed to async-record run to history:', err)
+    logger.warn('[dsh-moa] Failed to async-record run to history:', err)
     return null
   }
 }
@@ -182,7 +213,7 @@ export function readTailLinesSync(filePath, countNeeded = 50) {
 /**
  * Reads history runs with pagination (latest first).
  */
-export function getMoaHistory(limit = 20, offset = 0, filePath = DEFAULT_HISTORY_FILE) {
+export function getMoaHistory(limit = 20, offset = 0, filePath = getDefaultHistoryFile()) {
   try {
     if (!fs.existsSync(filePath)) {
       return { total: 0, runs: [] }
@@ -232,7 +263,7 @@ export function getMoaHistory(limit = 20, offset = 0, filePath = DEFAULT_HISTORY
 
     return { total, runs }
   } catch (err) {
-    console.warn('[dsh-moa] Failed to read history:', err)
+    logger.warn('[dsh-moa] Failed to read history:', err)
     return { total: 0, runs: [] }
   }
 }
@@ -241,7 +272,7 @@ export function getMoaHistory(limit = 20, offset = 0, filePath = DEFAULT_HISTORY
  * Calculates win-rate leaderboard and model performance statistics across history.
  * Employs in-memory caching keyed by file mtime and size for O(1) repeated queries.
  */
-export function getMoaLeaderboard(filePath = DEFAULT_HISTORY_FILE, options = {}) {
+export function getMoaLeaderboard(filePath = getDefaultHistoryFile(), options = {}) {
   try {
     if (!fs.existsSync(filePath)) {
       return { totalRuns: 0, models: [] }
@@ -335,7 +366,7 @@ export function getMoaLeaderboard(filePath = DEFAULT_HISTORY_FILE, options = {})
     _historyCache.leaderboards.set(filterKey, result)
     return result
   } catch (err) {
-    console.warn('[dsh-moa] Failed to calculate leaderboard:', err)
+    logger.warn('[dsh-moa] Failed to calculate leaderboard:', err)
     return { totalRuns: 0, models: [] }
   }
 }
@@ -343,7 +374,7 @@ export function getMoaLeaderboard(filePath = DEFAULT_HISTORY_FILE, options = {})
 /**
  * Retrieves a single history run by ID.
  */
-export function getMoaRunById(runId, filePath = DEFAULT_HISTORY_FILE) {
+export function getMoaRunById(runId, filePath = getDefaultHistoryFile()) {
   try {
     if (!fs.existsSync(filePath)) return null
     const raw = fs.readFileSync(filePath, 'utf8')
@@ -363,7 +394,7 @@ export function getMoaRunById(runId, filePath = DEFAULT_HISTORY_FILE) {
 /**
  * Exports history data in JSON or CSV format with optional preset filtering.
  */
-export function exportMoaHistory(filePath = DEFAULT_HISTORY_FILE, options = {}) {
+export function exportMoaHistory(filePath = getDefaultHistoryFile(), options = {}) {
   try {
     if (!fs.existsSync(filePath)) {
       return options?.format === 'csv' ? 'id,timestamp,preset,winnerModel,totalTokens,totalCostUsd,durationMs\n' : '[]'
@@ -405,7 +436,7 @@ export function exportMoaHistory(filePath = DEFAULT_HISTORY_FILE, options = {})
 
     return JSON.stringify(records, null, 2)
   } catch (err) {
-    console.warn('[dsh-moa] Failed to export history:', err)
+    logger.warn('[dsh-moa] Failed to export history:', err)
     return options?.format === 'csv' ? '' : '[]'
   }
 }

package/lib/index.js

@@ -1,3 +1,4 @@
+import { setLogger, logger } from './logger.js'
 import { refreshCatalogInBackground } from './pricing.js'
 /**
  * DeepSeek Harness Mixture of Agents (MoA) Plugin
@@ -50,8 +51,8 @@ export const PriceRow = z.object({
 })
 
 export const ModelSlotSchema = z.object({
-  provider: z.string().default('opencode-go'),
-  model: z.string().default('deepseek-v4-flash'),
+  provider: z.string().default(''),
+  model: z.string().default(''),
   role_persona: z.string().default(''),
   temperature: z.number().default(-1),
 })
@@ -65,7 +66,7 @@ export const PresetSchema = z.object({
   quorum_enabled: z.boolean().default(false),
   grace_period_sec: z.number().default(10),
   reference_models: z.array(ModelSlotSchema).default([]),
-  aggregator: ModelSlotSchema.default({ provider: 'codex', model: 'gpt-5.6-sol' }),
+  aggregator: ModelSlotSchema.default({ provider: '', model: '' }),
   aggregator_fallbacks: z.array(ModelSlotSchema).default([]),
   reference_temperature: z.number().default(0.6),
   aggregator_temperature: z.number().default(0.4),
@@ -84,7 +85,7 @@ export const PresetSchema = z.object({
   judge_voting_strategy: z.string().default('majority'),
   composite_merge_enabled: z.boolean().default(false),
   smart_routing_enabled: z.boolean().default(false),
-  smart_routing_model: ModelSlotSchema.default({ provider: 'opencode-go', model: 'jev' }),
+  smart_routing_model: ModelSlotSchema.default({ provider: '', model: '' }),
   budget_guard_enabled: z.boolean().default(false),
   max_budget_usd: z.number().default(0),
   budget_action: z.string().default('trim'),
@@ -99,7 +100,7 @@ export const Config = z.object({
   enabled: z.boolean().default(true).volatile(),
   default_preset: z.string().default('default').volatile(),
   smart_routing_enabled: z.boolean().default(false).volatile(),
-  smart_routing_model: ModelSlotSchema.default({ provider: 'opencode-go', model: 'jev' }).volatile(),
+  smart_routing_model: ModelSlotSchema.default({ provider: '', model: '' }).volatile(),
   prices: z.dict(PriceRow).default({}).volatile(),
   presets: z.array(PresetSchema).default([
     {
@@ -107,10 +108,10 @@ export const Config = z.object({
       enabled: true,
       ask_clarifying_questions: true,
       reference_models: [
-        { provider: 'opencode-go', model: 'deepseek-v4-flash' },
-        { provider: 'grok', model: 'grok-build-0.1' },
+        { provider: '', model: '', role_persona: 'proposer' },
+        { provider: '', model: '', role_persona: 'challenger' },
       ],
-      aggregator: { provider: 'codex', model: 'gpt-5.6-sol' },
+      aggregator: { provider: '', model: '' },
       reference_temperature: 0.6,
       aggregator_temperature: 0.4,
       max_tokens: 4096,
@@ -121,9 +122,9 @@ export const Config = z.object({
       enabled: true,
       ask_clarifying_questions: false,
       reference_models: [
-        { provider: 'opencode-go', model: 'deepseek-v4-flash' },
+        { provider: '', model: '', role_persona: 'fast' },
       ],
-      aggregator: { provider: 'opencode-go', model: 'deepseek-v4-flash' },
+      aggregator: { provider: '', model: '' },
       reference_temperature: 0.6,
       aggregator_temperature: 0.2,
       max_tokens: 4096,
@@ -134,10 +135,10 @@ export const Config = z.object({
       enabled: true,
       ask_clarifying_questions: true,
       reference_models: [
-        { provider: 'grok', model: 'grok-build-0.1' },
-        { provider: 'commandcode', model: 'deepseek/deepseek-v4-flash' },
+        { provider: '', model: '', role_persona: 'architect' },
+        { provider: '', model: '', role_persona: 'critic' },
       ],
-      aggregator: { provider: 'codex', model: 'gpt-5.6-sol' },
+      aggregator: { provider: '', model: '' },
       reference_temperature: 0.6,
       aggregator_temperature: 0.2,
       max_tokens: 8192,
@@ -163,6 +164,7 @@ export function plainConfig(value) {
 }
 
 export function apply(ctx, config) {
+  if (ctx.logger) setLogger(ctx.logger)
   refreshCatalogInBackground()
 
   let localConfig = plainConfig(config ?? {})
@@ -209,7 +211,7 @@ export function apply(ctx, config) {
         await settingsService.update(NS, plain)
       }
     } catch (err) {
-      console.warn('[dsh-moa] Settings persistence warning:', err?.message || err)
+      logger.warn('[dsh-moa] Settings persistence warning:', err?.message || err)
     }
     return localConfig
   }
@@ -375,8 +377,8 @@ export function apply(ctx, config) {
           }
         }
         const targetPreset = (cfg.presets || []).find((p) => p.name === parsed.presetName) || cfg.presets?.[0]
-        const aggProvider = targetPreset?.aggregator?.provider || 'codex'
-        const aggModel = targetPreset?.aggregator?.model || 'gpt-5.6-sol'
+        const aggProvider = targetPreset?.aggregator?.provider || ''
+        const aggModel = targetPreset?.aggregator?.model || ''
         const sessCwd = event.cwd || event.session?.cwd || (event.session?.path ? path.dirname(event.session.path) : undefined) || process.cwd()
 
         const turnContext = {
@@ -388,6 +390,8 @@ export function apply(ctx, config) {
           callLlm,
           prices: cfg.prices || {},
           liveCanvas,
+          webServerPort: ctx.webServer?.port,
+          timeMachineEngine: ctx.get?.('timeMachineEngine') || ctx.timeMachineEngine,
         }
 
         if (event.signal) {

package/lib/logger.js

@@ -0,0 +1,40 @@
+/**
+ * Context logger abstraction for dsh-moa.
+ * Avoids raw direct console warnings in server-side modules and respects Cordis ctx.logger.
+ */
+let currentLogger = null
+
+export function setLogger(logger) {
+  currentLogger = logger
+}
+
+export const logger = {
+  warn(...args) {
+    if (currentLogger && typeof currentLogger.warn === 'function') {
+      currentLogger.warn(...args)
+    } else if (typeof console !== 'undefined' && typeof console.debug === 'function') {
+      console.debug(...args)
+    }
+  },
+  debug(...args) {
+    if (currentLogger && typeof currentLogger.debug === 'function') {
+      currentLogger.debug(...args)
+    } else if (typeof console !== 'undefined' && typeof console.debug === 'function') {
+      console.debug(...args)
+    }
+  },
+  info(...args) {
+    if (currentLogger && typeof currentLogger.info === 'function') {
+      currentLogger.info(...args)
+    } else if (typeof console !== 'undefined' && typeof console.debug === 'function') {
+      console.debug(...args)
+    }
+  },
+  error(...args) {
+    if (currentLogger && typeof currentLogger.error === 'function') {
+      currentLogger.error(...args)
+    } else if (typeof console !== 'undefined' && typeof console.debug === 'function') {
+      console.debug(...args)
+    }
+  },
+}

package/lib/moa-candidates.js

@@ -1,3 +1,4 @@
+import { logger } from './logger.js'
 /**
  * DeepSeek Harness Mixture of Agents (MoA) — Candidate Fan-Out & Retry
  * With Per-Candidate Temperature, Temperature Gradient & Local Fallback Resilience
@@ -200,7 +201,7 @@ export async function runReferencesParallel(references, messages, options = {},
               }
               break
             } catch (fbErr) {
-              console.warn(`[dsh-moa] Fallback ${fbLabel} also failed:`, fbErr?.message || fbErr)
+              logger.warn(`[dsh-moa] Fallback ${fbLabel} also failed:`, fbErr?.message || fbErr)
             }
           }
         }
@@ -208,7 +209,7 @@ export async function runReferencesParallel(references, messages, options = {},
         if (!fallbackRecovered) {
           finishedCount++
           const errMsg = err?.message || String(err)
-          console.warn(`[dsh-moa] Reference ${label} failed:`, errMsg)
+          logger.warn(`[dsh-moa] Reference ${label} failed:`, errMsg)
           if (typeof onProgress === 'function') {
             onProgress(`⚠️ *Candidate ${i + 1}/${total} (${label}) error: ${errMsg}*\n`)
           }

package/lib/moa-router.js

@@ -1,6 +1,6 @@
 /**
  * Smart Preset Router for Mixture of Agents (MoA).
- * Supports heuristic keyword classification and optional JEV/LLM zero-shot routing.
+ * Supports heuristic keyword classification and optional LLM zero-shot routing.
  */
 
 const INTENT_RULES = [
@@ -48,7 +48,7 @@ export async function resolvePresetForPrompt({
     return { presetName: safeDefault, reason: 'default', isAutoRouted: false }
   }
 
-  // 1. If LLM routing model (e.g. JEV) is configured and callable, run fast zero-shot classifier
+  // 1. If LLM routing model is configured and callable, run fast zero-shot classifier
   if (routingModel?.provider && routingModel?.model && typeof callLlm === 'function') {
     try {
       const systemPrompt = `You are the MoA Preset Router. Given user prompt, classify which preset is best suited.

package/lib/moa-runner.js

@@ -1,9 +1,10 @@
+import { logger } from './logger.js'
 import path from 'node:path'
 import crypto from 'node:crypto'
 import { bestEffort } from './best-effort.js'
 import { extractFileBlocks, collectProjectContext, formatProjectContext, isRefinementTask, writeCandidateWorkspace, promoteCandidateWorkspace, cleanMoaWorkspaces, verifyFileSyntax } from './file-workspace.js'
 import { estimateTokenCost, summarizeMoAUsage } from './pricing.js'
-import { recordMoaRun, candidatesForHistory } from './history.js'
+import { recordMoaRunAsync, candidatesForHistory, isTestEnvironment } from './history.js'
 import { createPromotedPreview } from './live-canvas.js'
 import { slotLabel, cleanAdvisoryMessages, isBroadPromptRequiringQuestions, buildQuestionSynthesisPrompt, buildCuratorSynthesisPrompt, buildSynthesisPrompt, buildPeerCritiquePrompt, ROLE_PERSONA_PROMPTS, SYSTEM_ROLE_PROPOSER, ANTIPATTERNS_RUBRIC } from './moa-prompts.js'
 import { parseWinnerIndex, parseRecommendedAssembler, parseMoACommand, stripOrSummarizeCode, formatMoAResponse } from './moa-parser.js'
@@ -40,15 +41,29 @@ export async function runMoAPipeline({
   testGateEnabled = null,
   testCommand = null,
   execFn = null,
+  webServerPort = null,
+  timeMachineEngine = null,
+  timeMachineUrl = null,
+  force = isTestEnvironment() ? true : false,
+  checkpoint = true,
+  checkpointFn = null,
 }) {
+  const promoteOpts = {
+    webServerPort,
+    timeMachineEngine,
+    timeMachineUrl,
+    force: Boolean(force),
+    checkpoint,
+    checkpointFn,
+  }
   if (signal?.aborted) return { error: new Error('Turn aborted') }
   const startTime = Date.now()
 
   // 1. Resolve configurations
   const referenceModels = Array.isArray(preset?.reference_models) && preset.reference_models.length > 0
-    ? preset.reference_models : [{ provider: 'opencode-go', model: 'deepseek-v4-flash' }]
+    ? preset.reference_models : [{ provider: '', model: '' }]
   const primaryJudge = preset?.aggregator?.provider && preset?.aggregator?.model
-    ? preset.aggregator : { provider: 'codex', model: 'gpt-5.6-sol' }
+    ? preset.aggregator : { provider: '', model: '' }
 
   const fallbackJudges = Array.isArray(preset?.aggregator_fallbacks) ? preset.aggregator_fallbacks : []
   const judgesChain = [primaryJudge, ...fallbackJudges]
@@ -227,7 +242,7 @@ export async function runMoAPipeline({
       }
       qUsage = estimateTokenCost(primaryJudge, qFallbackUsage, prices)
     } catch (err) {
-      console.warn('[dsh-moa] Questionnaire synthesis failed, proceeding with fallback questions:', err)
+      logger.warn('[dsh-moa] Questionnaire synthesis failed, proceeding with fallback questions:', err)
       questionsContent = `### Clarification of Requirements: "${userPrompt}"\n\n1. **Architecture & Scope**: Single-file deliverable or multi-module project structure?\n2. **Design & Style**: Minimalist, dark mode, or clean neutral theme?\n3. **Functional Priorities**: Core MVP or comprehensive extended implementation?\n\n*Reply with your preferences (e.g. "1, 2") or proceed with defaults.*`
     }
 
@@ -237,7 +252,7 @@ export async function runMoAPipeline({
     const durationMs = Date.now() - startTime
 
     try {
-      recordMoaRun({
+      await recordMoaRunAsync({
         prompt: userPrompt,
         preset: preset?.name || 'default',
         isRefinement,
@@ -251,7 +266,7 @@ export async function runMoAPipeline({
         durationMs,
       }, historyFilePath || undefined)
     } catch (histErr) {
-      console.warn('[dsh-moa] Failed to record questionnaire run in history:', histErr?.message || histErr)
+      logger.warn('[dsh-moa] Failed to record questionnaire run in history:', histErr?.message || histErr)
     }
 
     return {
@@ -282,7 +297,7 @@ export async function runMoAPipeline({
     const single = successfulRefs[0]
     let promotedFiles = []
     if (single.files?.length > 0) {
-      promotedFiles = await promoteCandidateWorkspace(cwd, single.index)
+      promotedFiles = await promoteCandidateWorkspace(cwd, single.index, promoteOpts)
     } else {
       await cleanMoaWorkspaces(cwd)
     }
@@ -293,7 +308,7 @@ export async function runMoAPipeline({
     const durationMs = Date.now() - startTime
 
     try {
-      recordMoaRun({
+      await recordMoaRunAsync({
         prompt: userPrompt,
         preset: preset?.name || 'default',
         isRefinement,
@@ -308,7 +323,7 @@ export async function runMoAPipeline({
         durationMs,
       }, historyFilePath || undefined)
     } catch (histErr) {
-      console.warn('[dsh-moa] Failed to record fast synthesis run in history:', histErr?.message || histErr)
+      logger.warn('[dsh-moa] Failed to record fast synthesis run in history:', histErr?.message || histErr)
     }
 
     return {
@@ -376,7 +391,7 @@ export async function runMoAPipeline({
           cand.costUsd = Number(((cand.costUsd || 0) + extraCost.costUsd).toFixed(5))
         }
       } catch (r2CostErr) {
-        console.warn('[dsh-moa] Failed to estimate Round 2 cost:', r2CostErr?.message || r2CostErr)
+        logger.warn('[dsh-moa] Failed to estimate Round 2 cost:', r2CostErr?.message || r2CostErr)
       }
     })
     await Promise.allSettled(r2Promises)
@@ -460,7 +475,7 @@ export async function runMoAPipeline({
       break
     } catch (err) {
       lastJudgeError = err
-      console.warn(`[dsh-moa] Judge ${currentLabel} failed:`, err)
+      logger.warn(`[dsh-moa] Judge ${currentLabel} failed:`, err)
       if (typeof onProgress === 'function') {
         const nextJudge = judgesChain[jIdx + 1]
         const nextHint = nextJudge ? ` Trying fallback ${slotLabel(nextJudge)}...` : ''
@@ -491,12 +506,12 @@ export async function runMoAPipeline({
   const keepWorkspaces = allowCandidateOverride
   if (synthesizedFiles.length > 0) {
     await writeCandidateWorkspace(cwd, 'curator-synthesis', synthesizedFiles)
-    promotedFiles = await promoteCandidateWorkspace(cwd, 'curator-synthesis', { keepMoa: keepWorkspaces })
+    promotedFiles = await promoteCandidateWorkspace(cwd, 'curator-synthesis', { ...promoteOpts, keepMoa: keepWorkspaces })
   } else if (referenceOutputs[winningIndex - 1]?.files?.length > 0) {
-    promotedFiles = await promoteCandidateWorkspace(cwd, winningIndex, { keepMoa: keepWorkspaces })
+    promotedFiles = await promoteCandidateWorkspace(cwd, winningIndex, { ...promoteOpts, keepMoa: keepWorkspaces })
   } else if (successfulRefs[0]?.files?.length > 0) {
     const fallbackIdx = successfulRefs[0].index
-    promotedFiles = await promoteCandidateWorkspace(cwd, fallbackIdx, { keepMoa: keepWorkspaces })
+    promotedFiles = await promoteCandidateWorkspace(cwd, fallbackIdx, { ...promoteOpts, keepMoa: keepWorkspaces })
   } else if (!keepWorkspaces) {
     await cleanMoaWorkspaces(cwd)
   }
@@ -529,7 +544,7 @@ export async function runMoAPipeline({
   }
 
   try {
-    recordMoaRun({
+    await recordMoaRunAsync({
       id: runId,
       prompt: userPrompt,
       preset: preset?.name || 'default',
@@ -546,7 +561,7 @@ export async function runMoAPipeline({
       durationMs,
     }, historyFilePath || undefined)
   } catch (histErr) {
-    console.warn('[dsh-moa] Failed to record run in history:', histErr)
+    logger.warn('[dsh-moa] Failed to record run in history:', histErr)
   }
 
   return {

package/lib/moa-stream.js

@@ -9,7 +9,7 @@ import { runMoAPipeline } from './moa-runner.js'
 /**
  * Streams a full MoA turn into chat with live aggregator tokens and progress feedback.
  */
-export async function* streamMoATurn({ targetPreset, userPrompt, messages, callLlm, cwd, prices, historyFilePath, liveCanvas }, options = {}) {
+export async function* streamMoATurn({ targetPreset, userPrompt, messages, callLlm, cwd, prices, historyFilePath, liveCanvas, webServerPort, timeMachineEngine, force }, options = {}) {
   const signal = options?.signal
   if (signal?.aborted) return
 
@@ -40,6 +40,9 @@ export async function* streamMoATurn({ targetPreset, userPrompt, messages, callL
     prices,
     historyFilePath,
     liveCanvas,
+    webServerPort,
+    timeMachineEngine,
+    force,
     signal,
   })
     .catch((err) => ({ error: err }))

package/lib/moa-test-gate.js

@@ -4,6 +4,7 @@ import fsSync from 'node:fs'
 import path from 'node:path'
 import { spawn } from 'node:child_process'
 import { assertPathContained } from './file-workspace.js'
+import { bestEffort } from './best-effort.js'
 
 /**
  * Resolves the directory for candidate sandbox.
@@ -179,9 +180,9 @@ export async function runCandidateTestGate({
     }
   } finally {
     if (stageDir) {
-      try {
-        await fs.rm(stageDir, { recursive: true, force: true })
-      } catch {}
+      await bestEffort('moa-test-gate cleanup stageDir', () =>
+        fs.rm(stageDir, { recursive: true, force: true })
+      )
     }
   }
 }

package/lib/pricing.js

@@ -11,7 +11,21 @@ import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 
 export const CATALOG_URL = 'https://openrouter.ai/api/v1/models'
-export const CACHE_FILE = join(homedir(), '.dsh', 'storages', 'dsh-moa-catalog.json')
+
+export function getDefaultCacheFile() {
+  if (process.env.DSH_CATALOG_FILE) {
+    return process.env.DSH_CATALOG_FILE
+  }
+  if (process.env.DSH_STORAGE_DIR) {
+    return join(process.env.DSH_STORAGE_DIR, 'dsh-moa-catalog.json')
+  }
+  const baseDir = process.env.DSH_HOME
+    ? join(process.env.DSH_HOME, '.dsh')
+    : join(homedir(), '.dsh')
+  return join(baseDir, 'storages', 'dsh-moa-catalog.json')
+}
+
+export const CACHE_FILE = getDefaultCacheFile()
 export const REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000 // 24 hours
 
 /**
@@ -43,7 +57,7 @@ export function resetMemoryCatalog() {
 /**
  * Load cached catalog from disk into memory.
  */
-export function loadCachedCatalog(cachePath = CACHE_FILE) {
+export function loadCachedCatalog(cachePath = getDefaultCacheFile()) {
   if (memoryCatalog && memoryCachePath === cachePath) return memoryCatalog
   try {
     if (existsSync(cachePath)) {
@@ -69,7 +83,7 @@ export function loadCachedCatalog(cachePath = CACHE_FILE) {
  */
 export async function fetchCatalog({
   url = CATALOG_URL,
-  cachePath = CACHE_FILE,
+  cachePath = getDefaultCacheFile(),
   signal = null,
 } = {}) {
   try {
@@ -118,7 +132,7 @@ export async function fetchCatalog({
 /**
  * Background refresh catalog if stale (> 24 hours).
  */
-export function refreshCatalogInBackground(cachePath = CACHE_FILE) {
+export function refreshCatalogInBackground(cachePath = getDefaultCacheFile()) {
   const catalog = loadCachedCatalog(cachePath)
   const isStale = !lastFetchedAt || Date.now() - lastFetchedAt > REFRESH_INTERVAL_MS
   if (isStale) {
@@ -134,16 +148,20 @@ export function refreshCatalogInBackground(cachePath = CACHE_FILE) {
 /**
  * Resolve price rates (USD per 1M tokens) for a given provider/model slot.
  */
-export function resolveModelRates(slot = {}, customPrices = {}, cachePath = CACHE_FILE) {
+export function resolveModelRates(slot = {}, customPrices = {}, cachePath = getDefaultCacheFile()) {
   const provider = (slot?.provider || '').trim().toLowerCase()
   const model = (slot?.model || '').trim().toLowerCase()
   const fullKey = provider ? `${provider}/${model}` : model
+  const colonKey = provider ? `${provider}:${model}` : model
 
   // 1. Check custom user overrides in config
   if (customPrices && typeof customPrices === 'object') {
     if (customPrices[fullKey]) return normalizeRates(customPrices[fullKey])
+    if (customPrices[colonKey]) return normalizeRates(customPrices[colonKey])
     if (customPrices[model]) return normalizeRates(customPrices[model])
-    if (provider && customPrices[`${provider}/*`]) return normalizeRates(customPrices[`${provider}/*`])
+    if (provider && (customPrices[`${provider}/*`] || customPrices[`${provider}:*`])) {
+      return normalizeRates(customPrices[`${provider}/*`] || customPrices[`${provider}:*`])
+    }
     if (customPrices['*']) return normalizeRates(customPrices['*'])
   }
 
@@ -271,7 +289,7 @@ function normalizeRates(rate) {
 /**
  * Estimate USD cost and token totals for a single model call.
  */
-export function estimateTokenCost(slot = {}, usage = {}, customPrices = {}, cachePath = CACHE_FILE) {
+export function estimateTokenCost(slot = {}, usage = {}, customPrices = {}, cachePath = getDefaultCacheFile()) {
   const promptTokens = usage.prompt_tokens ?? usage.inputTokens ?? usage.input ?? usage.promptTokens ?? 0
   const completionTokens = usage.completion_tokens ?? usage.outputTokens ?? usage.output ?? usage.completionTokens ?? 0
   const cacheHitTokens = usage.prompt_tokens_details?.cached_tokens ?? usage.cacheHitTokens ?? 0

package/lib/routes.js

@@ -46,7 +46,11 @@ ctx.effect(() => {
     return ctx.webServer.register({
       kind: 'exact',
       path: '/dsh-moa/status',
-      handler: (_req, res) => {
+      handler: (req, res) => {
+        if (req.method !== 'GET') {
+          writeJson(res, 405, { ok: false, error: 'GET required' })
+          return
+        }
         try {
           const cfg = live()
           writeJson(res, 200, {
@@ -67,7 +71,11 @@ ctx.effect(() => {
     return ctx.webServer.register({
       kind: 'exact',
       path: '/dsh-moa/models',
-      handler: async (_req, res) => {
+      handler: async (req, res) => {
+        if (req.method !== 'GET') {
+          writeJson(res, 405, { ok: false, error: 'GET required' })
+          return
+        }
         if (_modelsCache.models.length > 0 && Date.now() - _modelsCache.timestamp < MODELS_CACHE_TTL) {
           writeJson(res, 200, { ok: true, models: _modelsCache.models, cached: true })
           return
@@ -94,7 +102,7 @@ ctx.effect(() => {
               }
             }
           } catch (e) {
-            console.warn('[dsh-moa] ctx.llm.listAvailableModels error:', e)
+            ctx.logger?.warn?.('[dsh-moa] ctx.llm.listAvailableModels error:', e)
           }
 
           try {
@@ -119,7 +127,7 @@ ctx.effect(() => {
               await Promise.allSettled(queries)
             }
           } catch (e) {
-            console.warn('[dsh-moa] ctx.llm.listConfigurableProviders error:', e)
+            ctx.logger?.warn?.('[dsh-moa] ctx.llm.listConfigurableProviders error:', e)
           }
         }
 
@@ -156,7 +164,7 @@ ctx.effect(() => {
             }
           }
         } catch (e) {
-          console.warn('[dsh-moa] Error reading settings:', e)
+          ctx.logger?.warn?.('[dsh-moa] Error reading settings:', e)
         }
 
         _modelsCache = { timestamp: Date.now(), models: result }
@@ -241,8 +249,10 @@ ctx.effect(() => {
         }
         try {
           const u = new URL(req.url, 'http://localhost')
-          const limit = parseInt(u.searchParams.get('limit') || '20', 10)
-          const offset = parseInt(u.searchParams.get('offset') || '0', 10)
+          const rawLimit = parseInt(u.searchParams.get('limit') || '20', 10)
+          const rawOffset = parseInt(u.searchParams.get('offset') || '0', 10)
+          const limit = Math.max(1, Math.min(100, Number.isFinite(rawLimit) ? rawLimit : 20))
+          const offset = Math.max(0, Number.isFinite(rawOffset) ? rawOffset : 0)
           const data = getMoaHistory(limit, offset)
           writeJson(res, 200, { ok: true, ...data })
         } catch (err) {
@@ -309,7 +319,12 @@ ctx.effect(() => {
             return
           }
           const cwd = body?.cwd || process.cwd()
-          const promotedFiles = await promoteCandidateWorkspace(cwd, candidateIndex, { keepMoa: true })
+          const promotedFiles = await promoteCandidateWorkspace(cwd, candidateIndex, {
+            keepMoa: true,
+            port: ctx.webServer?.port,
+            timeMachineEngine: ctx.get?.('timeMachineEngine') || ctx.timeMachineEngine,
+            force: Boolean(body?.force),
+          })
           writeJson(res, 200, { ok: true, candidateIndex, promotedFiles, checkpoint: promotedFiles?.checkpoint || null })
         } catch (err) {
           writeJson(res, 500, { ok: false, error: err?.message || String(err) })
@@ -470,18 +485,26 @@ ctx.effect(() => {
           writeJson(res, 405, { ok: false, error: 'POST required' })
           return
         }
+        if (!isSafeWriteRequest(req)) {
+          writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
+          return
+        }
         try {
+          const cfg = live()
+          if (cfg.enabled === false) {
+            writeJson(res, 400, { ok: false, error: 'MoA is disabled in settings' })
+            return
+          }
           const raw = await readBody(req)
           const body = JSON.parse(raw || '{}')
           const prompt = body?.prompt || ''
-          const cfg = live()
           const result = await resolvePresetForPrompt({
             prompt,
             presets: cfg.presets || [],
             defaultPreset: cfg.default_preset || 'default',
             routingModel: cfg.smart_routing_model,
             callLlm,
-            enabled: true,
+            enabled: cfg.enabled !== false,
           })
           writeJson(res, 200, { ok: true, ...result })
         } catch (err) {
@@ -491,6 +514,9 @@ ctx.effect(() => {
     })
   }, 'dsh-moa: route preset endpoint')
 
+  let _lastRunTimestamp = 0
+  const RUN_MIN_INTERVAL_MS = 1000
+
   // Route: /dsh-moa/run
   ctx.effect(() => {
     return ctx.webServer.register({
@@ -505,6 +531,12 @@ ctx.effect(() => {
           writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
           return
         }
+        const now = Date.now()
+        if (now - _lastRunTimestamp < RUN_MIN_INTERVAL_MS) {
+          writeJson(res, 429, { ok: false, error: 'Rate limit exceeded: please wait before starting another run' })
+          return
+        }
+        _lastRunTimestamp = now
 
         try {
           const raw = await readBody(req)

package/lib/updater.js

@@ -2,7 +2,7 @@
 // Implements canonical DSH plugin-updater specification.
 
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, statSync, rmSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, resolve } from 'node:path';
@@ -183,8 +183,79 @@ export async function getUpdateStatus(options, target = runtime()) {
   };
 }
 
-async function installExact(target, packageSpec, options) {
+export function readLockPid(lockPath) {
+  try {
+    if (!existsSync(lockPath)) return undefined;
+    const stat = statSync(lockPath);
+    if (stat.isDirectory()) return undefined;
+    const content = readFileSync(lockPath, 'utf8').trim();
+    if (!content) return undefined;
+    try {
+      const parsed = JSON.parse(content);
+      if (parsed && typeof parsed.pid === 'number') return parsed.pid;
+    } catch (parseErr) { /* ignore json parse error */ }
+    const num = parseInt(content, 10);
+    if (!isNaN(num) && num > 0) return num;
+    const match = /\b(\d{1,8})\b/.exec(content);
+    if (match) return Number(match[1]);
+    return undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function isPidAlive(pid) {
+  if (typeof pid !== 'number' || isNaN(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code === 'EPERM';
+  }
+}
+
+export function checkAndCleanLock(profileDir, childPid) {
+  const lockPath = resolve(profileDir, 'package.json.lock');
+  if (!existsSync(lockPath)) return { locked: false };
+  const pid = readLockPid(lockPath);
+  if (pid !== undefined) {
+    if (isPidAlive(pid)) {
+      if (childPid !== undefined && pid === childPid) {
+        try {
+          rmSync(lockPath, { recursive: true, force: true });
+          return { locked: false, cleaned: true };
+        } catch (rmErr) { return { locked: true, pid }; }
+      }
+      return { locked: true, pid };
+    }
+    // PID is dead, remove stale lock
+    try {
+      rmSync(lockPath, { recursive: true, force: true });
+      return { locked: false, cleaned: true };
+    } catch (rmErr) { return { locked: true, pid }; }
+  }
+  // Unknown or empty lockfile format
+  if (childPid !== undefined) {
+    try {
+      rmSync(lockPath, { recursive: true, force: true });
+      return { locked: false, cleaned: true };
+    } catch (parseErr) { /* ignore json parse error */ }
+  }
+  return { locked: true };
+}
+
+export async function installExact(target, packageSpec, options = {}) {
   if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.');
+
+  const lockStatus = checkAndCleanLock(target.profileDir);
+  if (lockStatus.locked) {
+    const error = new Error('Another plugin installation is currently in progress.');
+    error.status = 409;
+    error.statusCode = 409;
+    error.code = 'ELOCKED';
+    throw error;
+  }
+
   await new Promise((resolvePromise, reject) => {
     // Note: Respect strict ecosystem quarantine policy without age bypass
     const args = [
@@ -201,13 +272,24 @@ async function installExact(target, packageSpec, options) {
     let detail = '';
     child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
     child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
+    let timedOut = false;
+    const timeoutMs = options.timeoutMs ?? UPDATE_TIMEOUT_MS;
     const timer = setTimeout(() => {
-      child.kill();
+      timedOut = true;
+      try { child.kill('SIGTERM'); } catch (killErr) { /* best-effort */ }
+      setTimeout(() => {
+        try { child.kill('SIGKILL'); } catch (killErr) { /* best-effort */ }
+        checkAndCleanLock(target.profileDir, child.pid);
+      }, 500).unref?.();
       reject(new Error('Update timed out; use the normal DSH update flow.'));
-    }, UPDATE_TIMEOUT_MS);
+    }, timeoutMs);
     child.once('error', error => { clearTimeout(timer); reject(error); });
-    child.once('exit', code => {
+    child.once('exit', (code, signal) => {
       clearTimeout(timer);
+      if (timedOut) {
+        checkAndCleanLock(target.profileDir, child.pid);
+        return;
+      }
       if (code === 0) resolvePromise();
       else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`));
     });
@@ -253,6 +335,11 @@ export function registerPluginUpdater(ctx, options) {
           json(response, 409, { error: 'This plugin is already updating.' });
           return;
         }
+        const lockStatus = checkAndCleanLock(target.profileDir);
+        if (lockStatus.locked) {
+          json(response, 409, { error: 'Another plugin installation is currently in progress.' });
+          return;
+        }
         installing = true;
         try {
           const before = await getUpdateStatus(options, target);
@@ -274,6 +361,10 @@ export function registerPluginUpdater(ctx, options) {
           installing = false;
         }
       } catch (error) {
+        if (error?.status === 409 || error?.statusCode === 409) {
+          json(response, 409, { error: error.message || 'Another plugin installation is currently in progress.' });
+          return;
+        }
         ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`);
         json(response, 503, { error: 'Plugin update failed; see server logs.' });
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.27",
+  "version": "0.2.30",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",
@@ -19,7 +19,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node --test test/*.test.mjs",
+    "test": "node --import ./test/_setup.mjs --test test/*.test.mjs",
     "build:client": "node scripts/build-client.mjs"
   },
   "keywords": [
@@ -27,8 +27,7 @@
     "dsh-plugin",
     "moa",
     "mixture-of-agents",
-    "slash-command",
-    "hermes-agent"
+    "slash-command"
   ],
   "repository": {
     "type": "git",