@goodandready/dsh-moa 0.2.36 → 0.2.38

package/lib/moa-test-gate.js

@@ -3,32 +3,47 @@ import fs from 'node:fs/promises'
 import fsSync from 'node:fs'
 import path from 'node:path'
 import { spawn } from 'node:child_process'
-import { assertPathContained } from './file-workspace.js'
+import { resolveCandidateFolder } from './file-workspace.js'
 import { bestEffort } from './best-effort.js'
 
+const MAX_CAPTURE_BYTES = 256 * 1024
+
+/**
+ * Returns a sanitized environment stripping sensitive tokens and secrets (#161).
+ */
+export function getScrubbedEnv(overrides = {}) {
+  const safeVars = new Set([
+    'PATH', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TMPDIR', 'TEMP', 'TMP',
+    'USER', 'LOGNAME', 'HOME', 'SHELL', 'TERM', 'NODE_ENV', 'SYSTEMROOT',
+    'WINDIR', 'COMSPEC', 'PATHEXT',
+  ])
+  const scrubbed = {}
+  for (const [key, val] of Object.entries(process.env)) {
+    if (!val || key.startsWith('MOA_')) continue
+    if (/(API_KEY|TOKEN|SECRET|PASSWORD|PASSWD|AUTH|CREDENTIAL|PRIVATE|KEY|ACCESS)/i.test(key)) {
+      continue
+    }
+    if (safeVars.has(key) || key.startsWith('LC_')) {
+      scrubbed[key] = val
+    }
+  }
+  return { ...scrubbed, ...overrides }
+}
+
 /**
  * Resolves the directory for candidate sandbox.
  */
-export function resolveCandidateDir(baseDir, candidateIndex) {
+export function resolveCandidateDir(baseDir, candidateIndex, options = {}) {
   if (!baseDir || candidateIndex === null || candidateIndex === undefined) return null
-  const targetStr = String(candidateIndex).trim()
-  const sanitizedTarget = targetStr.replace(/[^a-zA-Z0-9_-]/g, '')
-  const sub = /^\d+$/.test(sanitizedTarget) ? `candidate-${sanitizedTarget}` : (sanitizedTarget || 'candidate-1')
-  const moaRoot = path.join(baseDir, '.moa')
-  return assertPathContained(moaRoot, sub)
+  try {
+    return resolveCandidateFolder(baseDir, candidateIndex, options).candidateDir
+  } catch {
+    return null
+  }
 }
 
 /**
  * Executes a test command in a candidate sandbox or ephemeral test staging directory.
- *
- * @param {object} params
- * @param {string} params.cwd - Project root workspace directory
- * @param {number|string} params.candidateIndex - Index of candidate (1, 2, ...)
- * @param {string} params.testCommand - Shell command to execute (e.g. "npm test", "node --test")
- * @param {number} [params.timeoutMs=15000] - Execution timeout in ms
- * @param {number} [params.maxOutputChars=2000] - Maximum captured output chars
- * @param {function} [params.execFn] - Optional mock/test runner function
- * @returns {Promise<object|null>} Test result object or null if skipped
  */
 export async function runCandidateTestGate({
   cwd,
@@ -37,18 +52,14 @@ export async function runCandidateTestGate({
   timeoutMs = 15000,
   maxOutputChars = 2000,
   execFn = null,
+  runId = null,
 }) {
-  if (!cwd || !testCommand || typeof testCommand !== 'string') {
-    return null
-  }
-
+  if (!cwd || !testCommand || typeof testCommand !== 'string') return null
   const trimmedCmd = testCommand.trim()
   if (!trimmedCmd) return null
 
-  const candidateDir = resolveCandidateDir(cwd, candidateIndex)
-  if (!candidateDir || !fsSync.existsSync(candidateDir)) {
-    return null
-  }
+  const candidateDir = resolveCandidateDir(cwd, candidateIndex, { runId })
+  if (!candidateDir || !fsSync.existsSync(candidateDir)) return null
 
   const startTime = Date.now()
   let stageDir = null
@@ -66,13 +77,19 @@ export async function runCandidateTestGate({
           const rel = path.relative(cwd, src)
           if (!rel) return true
           const parts = rel.split(path.sep)
-          if (parts[0] === 'node_modules' || parts[0] === '.git' || parts[0] === '.moa') {
-            return false
-          }
-          return true
+          return parts[0] !== 'node_modules' && parts[0] !== '.git' && parts[0] !== '.moa'
         },
       })
 
+      // #162: Preserve ESM & CJS resolution by symlinking project node_modules
+      const baseNodeModules = path.join(cwd, 'node_modules')
+      const stageNodeModules = path.join(stageDir, 'node_modules')
+      if (fsSync.existsSync(baseNodeModules)) {
+        await bestEffort('symlink node_modules in test stage', () =>
+          fs.symlink(baseNodeModules, stageNodeModules, process.platform === 'win32' ? 'junction' : 'dir')
+        )
+      }
+
       await fs.cp(candidateDir, stageDir, { recursive: true })
       executionDir = stageDir
     }
@@ -98,22 +115,25 @@ export async function runCandidateTestGate({
       stderr = customRes?.stderr || ''
     } else {
       const nodePath = path.join(cwd, 'node_modules')
-      const env = {
-        ...process.env,
+      const env = getScrubbedEnv({
         MOA_CANDIDATE_INDEX: String(candidateIndex),
         MOA_CANDIDATE_DIR: candidateDir,
         MOA_BASE_DIR: cwd,
+        ...(runId ? { MOA_RUN_ID: String(runId) } : {}),
         NODE_PATH: process.env.NODE_PATH ? `${nodePath}:${process.env.NODE_PATH}` : nodePath,
-      }
+      })
 
       const runPromise = new Promise((resolve) => {
         let child
+        let timeoutHandle = null
+        let killEscalateHandle = null
+
         try {
           child = spawn(resolvedCmd, {
             cwd: executionDir,
             shell: true,
+            detached: process.platform !== 'win32',
             env,
-            timeout: timeoutMs,
           })
         } catch (spawnErr) {
           resolve({ exitCode: 1, stdout: '', stderr: spawnErr.message || String(spawnErr) })
@@ -122,15 +142,50 @@ export async function runCandidateTestGate({
 
         const outChunks = []
         const errChunks = []
+        let capturedBytes = 0
+
+        child.stdout?.on('data', (d) => {
+          if (capturedBytes < MAX_CAPTURE_BYTES) {
+            outChunks.push(d)
+            capturedBytes += d.length
+          }
+        })
+        child.stderr?.on('data', (d) => {
+          if (capturedBytes < MAX_CAPTURE_BYTES) {
+            errChunks.push(d)
+            capturedBytes += d.length
+          }
+        })
+
+        const killChild = (sig = 'SIGTERM') => {
+          if (!child || !child.pid) return
+          bestEffort('test-gate kill child process group', () => {
+            if (process.platform !== 'win32') {
+              process.kill(-child.pid, sig)
+            } else {
+              child.kill(sig)
+            }
+          })
+        }
 
-        child.stdout?.on('data', (d) => outChunks.push(d))
-        child.stderr?.on('data', (d) => errChunks.push(d))
+        if (timeoutMs > 0) {
+          timeoutHandle = setTimeout(() => {
+            killChild('SIGTERM')
+            killEscalateHandle = setTimeout(() => {
+              killChild('SIGKILL')
+            }, 1000)
+          }, timeoutMs)
+        }
 
         child.on('error', (err) => {
+          if (timeoutHandle) clearTimeout(timeoutHandle)
+          if (killEscalateHandle) clearTimeout(killEscalateHandle)
           resolve({ exitCode: 1, stdout: Buffer.concat(outChunks).toString('utf8'), stderr: err.message || String(err) })
         })
 
         child.on('close', (code, sig) => {
+          if (timeoutHandle) clearTimeout(timeoutHandle)
+          if (killEscalateHandle) clearTimeout(killEscalateHandle)
           const combinedErr = Buffer.concat(errChunks).toString('utf8')
           const finalErr = sig ? `${combinedErr}\nProcess terminated by signal ${sig}`.trim() : combinedErr
           resolve({
@@ -154,9 +209,7 @@ export async function runCandidateTestGate({
       : combinedOutput
 
     const passed = exitCode === 0
-    const summary = passed
-      ? `PASS (${durationMs}ms)`
-      : `FAIL (code ${exitCode}, ${durationMs}ms)`
+    const summary = passed ? `PASS (${durationMs}ms)` : `FAIL (code ${exitCode}, ${durationMs}ms)`
 
     return {
       candidateIndex,
@@ -199,12 +252,11 @@ export async function executeTestGateForCandidates({
 }) {
   const isEnabled = Boolean(options.testGateEnabled ?? preset.test_gate_enabled)
   const testCmd = options.testCommand || preset.test_command
-  if (!isEnabled || !testCmd || !cwd) {
-    return []
-  }
+  if (!isEnabled || !testCmd || !cwd) return []
 
   const timeoutMs = (preset.test_gate_timeout_sec || 15) * 1000
   const maxOutputChars = preset.test_gate_max_output_chars || 2000
+  const runId = options.runId || preset.runId
 
   if (typeof onProgress === 'function') {
     onProgress('🧪 *Test Execution Gate: Running test suite against candidate sandboxes...*\n')
@@ -221,6 +273,7 @@ export async function executeTestGateForCandidates({
       timeoutMs,
       maxOutputChars,
       execFn: options.execFn,
+      runId,
     })
 
     if (res) {
@@ -234,4 +287,4 @@ export async function executeTestGateForCandidates({
   }
 
   return results
-}
+}

package/lib/routes.js

@@ -323,7 +323,9 @@ ctx.effect(() => {
             return
           }
           const cwd = body?.cwd || process.cwd()
+          const runId = body?.runId
           const promotedFiles = await promoteCandidateWorkspace(cwd, candidateIndex, {
+            runId,
             keepMoa: true,
             port: ctx.webServer?.port,
             timeMachineEngine: ctx.get?.('timeMachineEngine') || ctx.timeMachineEngine,
@@ -359,8 +361,9 @@ ctx.effect(() => {
           const rawFile = u.searchParams.get('file') || ''
           const file = (rawFile && isSafeRelativePath(rawFile)) ? rawFile : ''
 
-          const fromFiles = await readCandidateFiles(cwd, from)
-          const toFiles = await readCandidateFiles(cwd, to)
+          const runId = u.searchParams.get('runId') || undefined
+          const fromFiles = await readCandidateFiles(cwd, from, { runId })
+          const toFiles = await readCandidateFiles(cwd, to, { runId })
 
           // Collect all unique file paths
           const allPaths = Array.from(new Set([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.36",
+  "version": "0.2.38",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",