@goodandready/dsh-moa 0.2.37 → 0.2.38

package/lib/file-workspace.js

@@ -2,7 +2,12 @@ import { bestEffort } from './best-effort.js'
 import { logger } from './logger.js'
 import vm from 'node:vm'
 import fs from 'node:fs/promises'
+import fsSync from 'node:fs'
 import path from 'node:path'
+/**
+ * In-memory serialization mutex to prevent interleaved promotions to the same baseDir.
+ */
+const promotionLocks = new Map()
 
 /**
  * Validates that an untrusted relative path is safe and does not traverse upwards.
@@ -12,12 +17,12 @@ export function isSafeRelativePath(relPath) {
   const trimmed = relPath.trim()
   if (!trimmed || path.isAbsolute(trimmed) || trimmed.startsWith('/') || trimmed.startsWith('\\')) return false
   const normalized = path.normalize(trimmed)
-  if (!normalized || normalized === '.' || normalized.startsWith('..') || path.isAbsolute(normalized)) return false
-  return true
+  return !(!normalized || normalized === '.' || normalized.startsWith('..') || path.isAbsolute(normalized))
 }
 
 /**
- * Asserts that a resolved path is strictly contained within baseDir.
+ * Asserts that a resolved path is strictly contained within baseDir, verifying
+ * both lexical boundaries and physical canonical symlink resolution.
  */
 export function assertPathContained(baseDir, subPath) {
   const resolvedBase = path.resolve(baseDir)
@@ -25,18 +30,66 @@ export function assertPathContained(baseDir, subPath) {
   if (resolvedTarget !== resolvedBase && !resolvedTarget.startsWith(resolvedBase + path.sep)) {
     throw new Error(`Path traversal violation: "${subPath}" escapes base directory "${baseDir}"`)
   }
+
+  try {
+    const realBase = fsSync.realpathSync(resolvedBase)
+    try {
+      const realTarget = fsSync.realpathSync(resolvedTarget)
+      if (realTarget !== realBase && !realTarget.startsWith(realBase + path.sep)) {
+        throw new Error(`Path traversal violation: symlink "${subPath}" resolves outside "${baseDir}"`)
+      }
+    } catch (targetErr) {
+      if (targetErr?.code === 'ENOENT') {
+        let curr = path.dirname(resolvedTarget)
+        while (curr === resolvedBase || curr.startsWith(resolvedBase + path.sep)) {
+          try {
+            const realCurr = fsSync.realpathSync(curr)
+            if (realCurr !== realBase && !realCurr.startsWith(realBase + path.sep)) {
+              throw new Error(`Path traversal violation: symlink ancestor in "${subPath}" resolves outside "${baseDir}"`)
+            }
+            break
+          } catch (ancestorErr) {
+            if (ancestorErr?.code === 'ENOENT') {
+              const parent = path.dirname(curr)
+              if (parent === curr) break
+              curr = parent
+              continue
+            }
+            throw ancestorErr
+          }
+        }
+      } else {
+        throw targetErr
+      }
+    }
+  } catch (baseErr) {
+    if (baseErr?.message?.startsWith('Path traversal violation')) throw baseErr
+  }
+
   return resolvedTarget
 }
 
+/**
+ * Resolves directory paths for candidate sandboxes with optional runId scoping.
+ */
+export function resolveCandidateFolder(baseDir, candidateTarget, options = {}) {
+  const targetStr = String(candidateTarget ?? 1).trim()
+  const sanitizedTarget = targetStr.replace(/[^a-zA-Z0-9_-]/g, '')
+  const sub = /^\d+$/.test(sanitizedTarget) ? `candidate-${sanitizedTarget}` : (sanitizedTarget || 'candidate-1')
+  const rawRunId = typeof options === 'string' ? options : options?.runId
+  const safeRunId = rawRunId ? String(rawRunId).trim().replace(/[^a-zA-Z0-9_-]/g, '') : null
+  const moaRoot = path.join(baseDir, '.moa')
+  const runRoot = safeRunId ? assertPathContained(moaRoot, safeRunId) : moaRoot
+  return { moaRoot, runRoot, safeRunId, sub, candidateDir: assertPathContained(runRoot, sub) }
+}
+
 /**
  * Parses markdown code blocks that specify file paths.
  */
 export function extractFileBlocks(text) {
   if (!text || typeof text !== 'string') return []
-
   const files = []
   const seenPaths = new Set()
-
   const addFile = (rawPath, fileContent) => {
     if (rawPath && isSafeRelativePath(rawPath) && !seenPaths.has(rawPath)) {
       seenPaths.add(rawPath)
@@ -44,24 +97,19 @@ export function extractFileBlocks(text) {
     }
   }
 
-  // Pattern 1: fenced blocks with file="..." or path="..." in info string
   const fenceRegex = /```[\w-]*\s+(?:file|path|filepath)=["']?([^\s"'\n\r]+)["']?[\r\n]+([\s\S]*?)```/gi
   let match
   while ((match = fenceRegex.exec(text)) !== null) addFile(match[1].trim(), match[2])
 
-  // Pattern 2: comment header: // File: path/to/file.ext or <!-- File: ... -->
   const commentRegex = /(?:\/\/|#|<!--)\s*(?:File|Path):\s*([^\s\n\r>]+)(?:\s*-->)?[\r\n]+```[\w-]*[\r\n]+([\s\S]*?)```/gi
   while ((match = commentRegex.exec(text)) !== null) addFile(match[1].trim(), match[2])
 
-  // Pattern 3: markdown header: ### File: path/to/file.ext
   const headerRegex = /#{1,4}\s+(?:File|Path):\s*([^\s\n\r]+)[\r\n]+```[\w-]*[\r\n]+([\s\S]*?)```/gi
   while ((match = headerRegex.exec(text)) !== null) addFile(match[1].trim(), match[2])
 
-  // Pattern 4: first line inside code block: // File: path/to/file.ext
   const inlineRegex = /```[\w-]*[\r\n]+(?:\/\/|#|<!--)\s*(?:File|Path):\s*([^\s\n\r>]+)(?:\s*-->)?[\r\n]+([\s\S]*?)```/gi
   while ((match = inlineRegex.exec(text)) !== null) addFile(match[1].trim(), match[2])
 
-  // Fallback: single anonymous code block if it contains complete HTML
   if (files.length === 0) {
     const htmlBlockRegex = /```(?:html)?[\r\n]+([\s\S]*?)```/gi
     let htmlMatch
@@ -73,7 +121,6 @@ export function extractFileBlocks(text) {
       }
     }
   }
-
   return files
 }
 
@@ -99,13 +146,8 @@ export function formatProjectContext(projectFiles = [], options = {}) {
 
 export async function collectProjectContext(baseDir, maxCharBudget = 16000) {
   if (!baseDir) return { files: [], totalChars: 0, skippedFiles: 0, skippedList: [] }
-
   const ignoreDirs = new Set(['node_modules', '.git', '.moa', '.worktrees', 'dist', 'build', '.dsh', '.next', '.nuxt', '.cache', 'coverage', '.turbo', '.idea', '.vscode'])
-  const codeExts = new Set([
-    '.html', '.htm', '.css', '.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx',
-    '.vue', '.svelte', '.json', '.py', '.md', '.txt', '.sh', '.yaml', '.yml',
-  ])
-
+  const codeExts = new Set(['.html', '.htm', '.css', '.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx', '.vue', '.svelte', '.json', '.py', '.md', '.txt', '.sh', '.yaml', '.yml'])
   const collected = []
   let totalChars = 0
   let skippedFiles = 0
@@ -173,57 +215,48 @@ export function isRefinementTask(userPrompt = '', projectFiles = null) {
   const p = userPrompt.toLowerCase().trim()
   if (!p) return false
 
-  // Greenfield creation phrases - ALWAYS fresh task
-  const freshPhrases = [
-    'from scratch', 'new project', 'new app', 'create a new', 'build a new', 'generate a new',
-    '从头开始', '新建项目', '创建项目', '新应用', '新建应用',
-    'с нуля', 'новый проект', 'новое приложение', 'создай проект', 'создай приложение', 'создай игру', 'создай сервис',
-    'сделай проект', 'сделай приложение', 'сделай игру',
-  ]
-  if (freshPhrases.some((phrase) => p.includes(phrase))) {
-    return false
-  }
-
-  // Modification keywords
-  const modKeywords = [
-    'add', 'change', 'update', 'fix', 'modify', 'refactor', 'improve', 'enhance', 'adjust',
-    'style', 'css', 'color', 'theme', 'bug',
-    '添加', '修改', '更新', '修复', '重构', '改进', '调整', '样式', '颜色', '主题',
-    'добавь', 'измени', 'поменяй', 'исправь', 'обнови', 'переделай', 'доработай', 'удали',
-    'темн', 'светл', 'цвет', 'кнопк', 'баг',
-  ]
+  const freshPhrases = ['from scratch', 'new project', 'new app', 'create a new', 'build a new', 'generate a new', '从头开始', '新建项目', '创建项目', '新应用', '新建应用', 'с нуля', 'новый проект', 'новое приложение', 'создай проект', 'создай приложение', 'создай игру', 'создай сервис', 'сделай проект', 'сделай приложение', 'сделай игру']
+  if (freshPhrases.some((phrase) => p.includes(phrase))) return false
 
+  const modKeywords = ['add', 'change', 'update', 'fix', 'modify', 'refactor', 'improve', 'enhance', 'adjust', 'style', 'css', 'color', 'theme', 'bug', '添加', '修改', '更新', '修复', '重构', '改进', '调整', '样式', '颜色', '主题', 'добавь', 'измени', 'поменяй', 'исправь', 'обнови', 'переделай', 'доработай', 'удали', 'темн', 'светл', 'цвет', 'кнопк', 'баг']
   return modKeywords.some((kw) => p.includes(kw))
 }
 
 /**
- * Writes candidate files into an isolated candidate workspace:
- * <baseDir>/.moa/candidate-<index>/
+ * Writes candidate files into an isolated candidate workspace.
+ * Uses atomic staging and swap to prevent stale file accumulation and dirty snapshots.
  */
-export async function writeCandidateWorkspace(baseDir, candidateIndex, files = []) {
+export async function writeCandidateWorkspace(baseDir, candidateIndex, files = [], options = {}) {
   if (!baseDir || !Array.isArray(files) || files.length === 0) return []
+  const { runRoot, sub, candidateDir } = resolveCandidateFolder(baseDir, candidateIndex, options)
+  await fs.mkdir(runRoot, { recursive: true })
 
-  const targetStr = String(candidateIndex).trim()
-  const sanitizedTarget = targetStr.replace(/[^a-zA-Z0-9_-]/g, '')
-  const sub = /^\d+$/.test(sanitizedTarget) ? `candidate-${sanitizedTarget}` : (sanitizedTarget || 'candidate-1')
-  const moaRoot = path.join(baseDir, '.moa')
-  const candidateDir = assertPathContained(moaRoot, sub)
-  await fs.mkdir(candidateDir, { recursive: true })
+  const tempSub = `.tmp-${sub}-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`
+  const tempCandidateDir = assertPathContained(runRoot, tempSub)
+  await fs.mkdir(tempCandidateDir, { recursive: true })
 
-  const written = []
-  for (const file of files) {
-    if (!isSafeRelativePath(file.relativePath)) continue
-    const fullPath = assertPathContained(candidateDir, file.relativePath)
-    await fs.mkdir(path.dirname(fullPath), { recursive: true })
-    await fs.writeFile(fullPath, file.content, 'utf8')
-    written.push({
-      relativePath: file.relativePath,
-      fullPath,
-      size: Buffer.byteLength(file.content, 'utf8'),
-    })
-  }
+  try {
+    const written = []
+    for (const file of files) {
+      if (!isSafeRelativePath(file.relativePath)) continue
+      const fullPath = assertPathContained(tempCandidateDir, file.relativePath)
+      await fs.mkdir(path.dirname(fullPath), { recursive: true })
+      await fs.writeFile(fullPath, file.content, 'utf8')
+      written.push({
+        relativePath: file.relativePath,
+        fullPath: path.join(candidateDir, file.relativePath),
+        size: Buffer.byteLength(file.content, 'utf8'),
+      })
+    }
 
-  return written
+    if (written.length === 0 && files.length > 0) throw new Error('No valid files could be written to candidate workspace')
+    await fs.rm(candidateDir, { recursive: true, force: true })
+    await fs.rename(tempCandidateDir, candidateDir)
+    return written
+  } catch (err) {
+    await bestEffort('clean tempCandidateDir on error', () => fs.rm(tempCandidateDir, { recursive: true, force: true }))
+    throw err
+  }
 }
 
 /**
@@ -238,8 +271,6 @@ export async function createPrePromotionCheckpoint(baseDir, candidateTarget, opt
   }
 
   const label = options.checkpointLabel || `moa-pre-promotion: candidate-${candidateTarget}`
-
-  // 1. Direct Cordis timeMachineEngine service call if available
   if (options.timeMachineEngine && typeof options.timeMachineEngine.createSnapshot === 'function') {
     const snap = await bestEffort('dsh-time-machine direct service createSnapshot', async () => {
       return await options.timeMachineEngine.createSnapshot(label, { cwd: baseDir })
@@ -247,7 +278,6 @@ export async function createPrePromotionCheckpoint(baseDir, candidateTarget, opt
     if (snap) return snap
   }
 
-  // 2. HTTP endpoint call if port or timeMachineUrl is provided
   const port = options.port || options.webServerPort || process.env.DSH_PORT || process.env.PORT
   if (!port && !options.timeMachineUrl) {
     logger.warn('[dsh-moa] Cannot create pre-promotion checkpoint: webServerPort is unknown and no timeMachineUrl provided')
@@ -255,7 +285,6 @@ export async function createPrePromotionCheckpoint(baseDir, candidateTarget, opt
   }
 
   const endpoint = options.timeMachineUrl || `http://127.0.0.1:${port}/dsh-time-machine/create`
-
   const snap = await bestEffort('dsh-time-machine pre-promotion checkpoint', async () => {
     const res = await fetch(endpoint, {
       method: 'POST',
@@ -272,20 +301,39 @@ export async function createPrePromotionCheckpoint(baseDir, candidateTarget, opt
   return snap || null
 }
 
+/**
+ * Promotes winning candidate workspace files into the base workspace.
+ * Serialized per baseDir and verifies symlink boundaries on promotion.
+ */
 export async function promoteCandidateWorkspace(baseDir, winningIndex, options = { keepMoa: false }) {
   if (!baseDir || winningIndex === null || winningIndex === undefined) return []
 
-  const targetStr = String(winningIndex).trim()
-  const sanitizedTarget = targetStr.replace(/[^a-zA-Z0-9_-]/g, '')
-  const sub = /^\d+$/.test(sanitizedTarget) ? `candidate-${sanitizedTarget}` : (sanitizedTarget || 'candidate-1')
-  const moaRoot = path.join(baseDir, '.moa')
-  const winningDir = assertPathContained(moaRoot, sub)
+  const key = path.resolve(baseDir)
+  const prevLock = promotionLocks.get(key) || Promise.resolve()
+  let releaseLock
+  const currentLock = new Promise((resolve) => { releaseLock = resolve })
+  promotionLocks.set(key, currentLock)
+
+  try {
+    await prevLock
+    return await doPromoteCandidateWorkspace(baseDir, winningIndex, options)
+  } finally {
+    releaseLock()
+    if (promotionLocks.get(key) === currentLock) {
+      promotionLocks.delete(key)
+    }
+  }
+}
+
+async function doPromoteCandidateWorkspace(baseDir, winningIndex, options = { keepMoa: false }) {
+  const { runRoot, moaRoot, safeRunId, candidateDir: winningDir } = resolveCandidateFolder(baseDir, winningIndex, options)
+  const cleanupTarget = safeRunId ? runRoot : moaRoot
 
   try {
     const entries = await getFilesRecursively(winningDir)
     if (entries.length === 0) {
       if (!options.keepMoa) {
-        await bestEffort('clean moaRoot on empty candidate', () => fs.rm(moaRoot, { recursive: true, force: true }))
+        await bestEffort('clean empty candidate folder', () => fs.rm(cleanupTarget, { recursive: true, force: true }))
       }
       return []
     }
@@ -298,35 +346,61 @@ export async function promoteCandidateWorkspace(baseDir, winningIndex, options =
     }
 
     const promoted = []
+    const baseReal = await fs.realpath(baseDir).catch(() => path.resolve(baseDir))
+
     for (const rel of entries) {
       if (!isSafeRelativePath(rel)) continue
       const srcPath = assertPathContained(winningDir, rel)
       const destPath = assertPathContained(baseDir, rel)
 
+      try {
+        const destLstat = await fs.lstat(destPath)
+        if (destLstat.isSymbolicLink()) {
+          const destReal = await fs.realpath(destPath)
+          if (destReal !== baseReal && !destReal.startsWith(baseReal + path.sep)) {
+            throw new Error(`Path traversal violation: promotion destination symlink "${rel}" resolves outside "${baseDir}"`)
+          }
+          await fs.unlink(destPath)
+        }
+      } catch (lstatErr) {
+        if (lstatErr?.code !== 'ENOENT') throw lstatErr
+      }
+
       await fs.mkdir(path.dirname(destPath), { recursive: true })
       await fs.copyFile(srcPath, destPath)
       promoted.push(rel)
     }
 
     if (checkpoint) promoted.checkpoint = checkpoint
-    if (!options.keepMoa) await fs.rm(moaRoot, { recursive: true, force: true })
+    if (!options.keepMoa) await fs.rm(cleanupTarget, { recursive: true, force: true })
 
     return promoted
   } catch (err) {
     if (!options.keepMoa) {
-      await bestEffort('clean moaRoot on promote error', () => fs.rm(moaRoot, { recursive: true, force: true }))
+      await bestEffort('clean candidate on promote error', () => fs.rm(cleanupTarget, { recursive: true, force: true }))
     }
     throw err
   }
 }
 
 /**
- * Cleans up any left-over .moa candidate folder.
+ * Cleans up candidate workspaces, optionally scoped to a single runId.
  */
-export async function cleanMoaWorkspaces(baseDir) {
+export async function cleanMoaWorkspaces(baseDir, options = {}) {
   if (!baseDir) return
+  const rawRunId = typeof options === 'string' ? options : options?.runId
+  const safeRunId = rawRunId ? String(rawRunId).trim().replace(/[^a-zA-Z0-9_-]/g, '') : null
   const moaRoot = path.join(baseDir, '.moa')
-  await bestEffort('cleanMoaWorkspaces', () => fs.rm(moaRoot, { recursive: true, force: true }))
+  if (safeRunId) {
+    const runRoot = path.join(moaRoot, safeRunId)
+    await bestEffort('cleanMoaWorkspaces runId', () => fs.rm(runRoot, { recursive: true, force: true }))
+    await bestEffort('clean empty moaRoot', async () => {
+      const remaining = await fs.readdir(moaRoot)
+      if (remaining.length === 0) await fs.rmdir(moaRoot)
+    })
+  } else {
+    await bestEffort('cleanMoaWorkspaces', () => fs.rm(moaRoot, { recursive: true, force: true }))
+  }
 }
 
 async function getFilesRecursively(dir) {
@@ -338,6 +412,13 @@ async function getFilesRecursively(dir) {
     return []
   }
 
+  let realDir
+  try {
+    realDir = await fs.realpath(dir)
+  } catch {
+    realDir = path.resolve(dir)
+  }
+
   async function scan(current, relPrefix = '') {
     let list
     try {
@@ -345,6 +426,18 @@ async function getFilesRecursively(dir) {
       for (const item of list) {
         const rel = relPrefix ? `${relPrefix}/${item.name}` : item.name
         const full = path.join(current, item.name)
+
+        if (item.isSymbolicLink()) {
+          try {
+            const realTarget = await fs.realpath(full)
+            if (realTarget === realDir || realTarget.startsWith(realDir + path.sep)) {
+              const st = await fs.stat(full)
+              if (st.isFile()) results.push(rel)
+            }
+          } catch (err) { logger.debug?.('[dsh-moa] symlink inspect skipped', err) }
+          continue
+        }
+
         if (item.isDirectory()) await scan(full, rel)
         else if (item.isFile()) results.push(rel)
       }
@@ -377,11 +470,7 @@ export function verifyFileSyntax(files = []) {
           .replace(/^([ \t]*)export\s+\*\s+from\s+[^;\n]+;?/gm, '$1')
         new vm.Script(transformed)
       } catch (err) {
-        warnings.push({
-          file: file.relativePath,
-          error: err?.message || String(err),
-          line: err?.lineNumber || 1,
-        })
+        warnings.push({ file: file.relativePath, error: err?.message || String(err), line: err?.lineNumber || 1 })
       }
     } else if (ext === '.json') {
       try {
@@ -395,23 +484,18 @@ export function verifyFileSyntax(files = []) {
       }
     }
   }
-
   return warnings
 }
 
 /**
- * Reads all files from a candidate workspace (.moa/candidate-N or .moa/curator-synthesis)
+ * Reads all files from a candidate workspace (.moa/candidate-N, .moa/curator-synthesis, or scoped under runId).
  */
-export async function readCandidateFiles(baseDir, candidateTarget) {
+export async function readCandidateFiles(baseDir, candidateTarget, options = {}) {
   if (!baseDir || candidateTarget === undefined || candidateTarget === null) return []
-  const targetStr = String(candidateTarget).trim()
-  const sanitizedTarget = targetStr.replace(/[^a-zA-Z0-9_-]/g, '')
-  const sub = /^\d+$/.test(sanitizedTarget) ? `candidate-${sanitizedTarget}` : (sanitizedTarget || 'candidate-1')
-  const moaRoot = path.join(baseDir, '.moa')
-
   let targetDir
   try {
-    targetDir = assertPathContained(moaRoot, sub)
+    const resolved = resolveCandidateFolder(baseDir, candidateTarget, options)
+    targetDir = resolved.candidateDir
   } catch {
     return []
   }
@@ -419,16 +503,21 @@ export async function readCandidateFiles(baseDir, candidateTarget) {
   try {
     const relFiles = await getFilesRecursively(targetDir)
     const result = []
+    const realTarget = await fs.realpath(targetDir).catch(() => targetDir)
+
     for (const rel of relFiles) {
       if (!isSafeRelativePath(rel)) continue
       try {
         const fullPath = assertPathContained(targetDir, rel)
+        const st = await fs.lstat(fullPath)
+        if (st.isSymbolicLink()) {
+          const realFile = await fs.realpath(fullPath)
+          if (realFile !== realTarget && !realFile.startsWith(realTarget + path.sep)) {
+            continue
+          }
+        }
         const content = await fs.readFile(fullPath, 'utf8')
-        result.push({
-          relativePath: rel,
-          content,
-          size: Buffer.byteLength(content, 'utf8'),
-        })
+        result.push({ relativePath: rel, content, size: Buffer.byteLength(content, 'utf8') })
       } catch {
         // file read error best-effort
       }
@@ -442,95 +531,59 @@ export async function readCandidateFiles(baseDir, candidateTarget) {
 /**
  * Computes a line-by-line diff between two text strings using LCS with
  * common prefix and suffix trimming for optimal O(delta) performance.
- * Returns an array of diff items: { type: 'same' | 'added' | 'removed', line: string, oldNum?: number, newNum?: number }
  */
 export function computeLineDiff(oldText = '', newText = '') {
   const oldLines = typeof oldText === 'string' ? oldText.split(/\r?\n/) : []
   const newLines = typeof newText === 'string' ? newText.split(/\r?\n/) : []
-
-  const n = oldLines.length
-  const m = newLines.length
-
+  const n = oldLines.length, m = newLines.length
   if (n === 0 && m === 0) return []
   if (oldText === newText) {
-    return oldLines.map((line, idx) => ({
-      type: 'same',
-      line,
-      oldNum: idx + 1,
-      newNum: idx + 1,
-    }))
+    return oldLines.map((line, idx) => ({ type: 'same', line, oldNum: idx + 1, newNum: idx + 1 }))
   }
 
-  // 1. Trim common prefix
   let start = 0
-  while (start < n && start < m && oldLines[start] === newLines[start]) {
-    start++
-  }
-
-  // 2. Trim common suffix
-  let oldEnd = n - 1
-  let newEnd = m - 1
+  while (start < n && start < m && oldLines[start] === newLines[start]) start++
+  let oldEnd = n - 1, newEnd = m - 1
   while (oldEnd >= start && newEnd >= start && oldLines[oldEnd] === newLines[newEnd]) {
     oldEnd--
     newEnd--
   }
 
   const prefixItems = []
-  for (let k = 0; k < start; k++) {
-    prefixItems.push({ type: 'same', line: oldLines[k], oldNum: k + 1, newNum: k + 1 })
-  }
+  for (let k = 0; k < start; k++) prefixItems.push({ type: 'same', line: oldLines[k], oldNum: k + 1, newNum: k + 1 })
 
   const suffixItems = []
   const suffixLen = (n - 1) - oldEnd
   for (let k = 0; k < suffixLen; k++) {
-    const oNum = oldEnd + 1 + k + 1
-    const nNum = newEnd + 1 + k + 1
-    suffixItems.push({ type: 'same', line: oldLines[oldEnd + 1 + k], oldNum: oNum, newNum: nNum })
+    suffixItems.push({ type: 'same', line: oldLines[oldEnd + 1 + k], oldNum: oldEnd + 2 + k, newNum: newEnd + 2 + k })
   }
 
   const subOld = oldLines.slice(start, oldEnd + 1)
   const subNew = newLines.slice(start, newEnd + 1)
-  const subN = subOld.length
-  const subM = subNew.length
-
+  const subN = subOld.length, subM = subNew.length
   const middleItems = []
 
   if (subN === 0) {
-    for (let j = 0; j < subM; j++) {
-      middleItems.push({ type: 'added', line: subNew[j], newNum: start + j + 1 })
-    }
+    for (let j = 0; j < subM; j++) middleItems.push({ type: 'added', line: subNew[j], newNum: start + j + 1 })
   } else if (subM === 0) {
-    for (let i = 0; i < subN; i++) {
-      middleItems.push({ type: 'removed', line: subOld[i], oldNum: start + i + 1 })
-    }
+    for (let i = 0; i < subN; i++) middleItems.push({ type: 'removed', line: subOld[i], oldNum: start + i + 1 })
   } else if (subN > 2000 || subM > 2000) {
-    for (let i = 0; i < subN; i++) {
-      middleItems.push({ type: 'removed', line: subOld[i], oldNum: start + i + 1 })
-    }
-    for (let j = 0; j < subM; j++) {
-      middleItems.push({ type: 'added', line: subNew[j], newNum: start + j + 1 })
-    }
+    for (let i = 0; i < subN; i++) middleItems.push({ type: 'removed', line: subOld[i], oldNum: start + i + 1 })
+    for (let j = 0; j < subM; j++) middleItems.push({ type: 'added', line: subNew[j], newNum: start + j + 1 })
   } else {
     const dp = Array.from({ length: subN + 1 }, () => new Uint16Array(subM + 1))
     for (let i = 0; i < subN; i++) {
       for (let j = 0; j < subM; j++) {
-        if (subOld[i] === subNew[j]) {
-          dp[i + 1][j + 1] = dp[i][j] + 1
-        } else {
-          dp[i + 1][j + 1] = Math.max(dp[i + 1][j], dp[i][j + 1])
-        }
+        dp[i + 1][j + 1] = subOld[i] === subNew[j] ? dp[i][j] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1])
       }
     }
 
-    let i = subN
-    let j = subM
+    let i = subN, j = subM
     const stack = []
-
     while (i > 0 || j > 0) {
       if (i > 0 && j > 0 && subOld[i - 1] === subNew[j - 1]) {
         stack.push({ type: 'same', line: subOld[i - 1], oldNum: start + i, newNum: start + j })
-        i--
-        j--
+        i--; j--
       } else if (j > 0 && (i === 0 || dp[i][j - 1] >= dp[i - 1][j])) {
         stack.push({ type: 'added', line: subNew[j - 1], newNum: start + j })
         j--
@@ -539,7 +592,6 @@ export function computeLineDiff(oldText = '', newText = '') {
         i--
       }
     }
-
     middleItems.push(...stack.reverse())
   }
 

package/lib/moa-runner.js

@@ -12,7 +12,6 @@ import { executeMultiJudgePanel, buildCompositeBlockDirectives } from './moa-mul
 import { applyBudgetGuardrails } from './moa-budget.js'
 import { extractPriorTurnBaseline, pruneMultiTurnMessages } from './moa-context.js'
 import { generateMoABenchmarkReport } from './moa-report.js'
-
 // Re-exports for consumers & backward compatibility
 export { slotLabel, cleanAdvisoryMessages, isBroadPromptRequiringQuestions, buildQuestionSynthesisPrompt, buildCuratorSynthesisPrompt, buildSynthesisPrompt, ANTIPATTERNS_RUBRIC } from './moa-prompts.js'
 export { parseWinnerIndex, parseRecommendedAssembler, parseMoACommand, stripOrSummarizeCode, formatMoAResponse } from './moa-parser.js'
@@ -20,7 +19,6 @@ export { estimateTokenCost, summarizeMoAUsage } from './pricing.js'
 export { REFERENCE_SYSTEM_PROMPT, callWithTransientRetry, runReferencesParallel } from './moa-candidates.js'
 export { executeTestGateForCandidates, runCandidateTestGate } from './moa-test-gate.js'
 export { streamMoATurn } from './moa-stream.js'
-
 /**
  * Executes the full Mixture of Agents pipeline.
  */
@@ -45,6 +43,7 @@ export async function runMoAPipeline({
   force = isTestEnvironment() ? true : false,
   checkpoint = true,
   checkpointFn = null,
+  runId: customRunId = null,
 }) {
   const promoteOpts = {
     webServerPort,
@@ -56,16 +55,13 @@ export async function runMoAPipeline({
   }
   if (signal?.aborted) return { error: new Error('Turn aborted') }
   const startTime = Date.now()
-
   // 1. Resolve configurations
   const referenceModels = Array.isArray(preset?.reference_models) && preset.reference_models.length > 0
     ? preset.reference_models : [{ provider: '', model: '' }]
   const primaryJudge = preset?.aggregator?.provider && preset?.aggregator?.model
     ? preset.aggregator : { provider: '', model: '' }
-
   const fallbackJudges = Array.isArray(preset?.aggregator_fallbacks) ? preset.aggregator_fallbacks : []
   const judgesChain = [primaryJudge, ...fallbackJudges]
-
   const refTemp = typeof preset?.reference_temperature === 'number' ? preset.reference_temperature : 0.6
   const aggTemp = typeof preset?.aggregator_temperature === 'number' ? preset.aggregator_temperature : 0.4
   const maxTokens = typeof preset?.max_tokens === 'number' ? preset.max_tokens : 4096
@@ -76,8 +72,7 @@ export async function runMoAPipeline({
   const candidateRetries = 1, refTimeoutSec = typeof preset?.reference_timeout_sec === 'number' ? preset.reference_timeout_sec : 60
   const aggTimeoutSec = typeof preset?.aggregator_timeout_sec === 'number' ? preset.aggregator_timeout_sec : 180
   const isBlindEvaluation = Boolean(preset?.blind_evaluation), isPeerCritiqueEnabled = Boolean(preset?.peer_critique_enabled)
-  const allowCandidateOverride = Boolean(preset?.allow_candidate_override), runId = crypto.randomUUID()
-
+  const allowCandidateOverride = Boolean(preset?.allow_candidate_override), runId = customRunId || null
   // Feature 6: Budget Guardrail check
   const budgetCheck = applyBudgetGuardrails({
     references: referenceModels,
@@ -109,7 +104,6 @@ export async function runMoAPipeline({
   if (budgetCheck.action === 'trim' && typeof onProgress === 'function') {
     onProgress(`✂️ *${budgetCheck.reason}*\n`)
   }
-
   // 2. Collect project context for refinement tasks
   const collectedCtx = await collectProjectContext(cwd, 16000)
   const isRefinement = Boolean(collectedCtx?.files?.length > 0 && isRefinementTask(userPrompt, collectedCtx.files))
@@ -128,19 +122,15 @@ export async function runMoAPipeline({
       skippedList: collectedCtx.skippedList,
     })
   }
-
   // 3. Build prompts & Feature 8 multi-turn context
   const priorTurnBaseline = preset?.multi_turn_enabled !== false ? extractPriorTurnBaseline(messages) : null
   const prunedHistory = preset?.multi_turn_enabled !== false ? pruneMultiTurnMessages(messages) : messages
-
   const candidateSystemPrompt = projectContext
     ? `${REFERENCE_SYSTEM_PROMPT}\n\n### Current Project Files & Context:\n${projectContext}`
     : REFERENCE_SYSTEM_PROMPT
-
   const askClarifyingQuestions = preset?.ask_clarifying_questions !== false
   const needsQuestions = askClarifyingQuestions && isBroadPromptRequiringQuestions(userPrompt, messages)
   const enrichedMessages = [...prunedHistory, { role: 'user', content: userPrompt }]
-
   // 4. Parallel fan-out to candidate models with temperature gradient & local fallback
   const referenceOutputs = await runReferencesParallel(
     effectiveReferences,
@@ -162,12 +152,10 @@ export async function runMoAPipeline({
     callLlm,
     onProgress
   )
-
   if (signal?.aborted) {
-    await cleanMoaWorkspaces(cwd)
+    await cleanMoaWorkspaces(cwd, { runId })
     return { error: new Error('Turn aborted') }
   }
-
   // Fail fast if all candidates failed
   const successfulRefs = referenceOutputs.filter((r) => r.ok)
   if (successfulRefs.length === 0) {
@@ -194,7 +182,6 @@ export async function runMoAPipeline({
       durationMs: Date.now() - startTime,
     }
   }
-
   // 5. Extract file blocks & write candidate workspaces
   for (let i = 0; i < referenceOutputs.length; i++) {
     const ref = referenceOutputs[i]
@@ -203,24 +190,21 @@ export async function runMoAPipeline({
     ref.files = files
     if (files.length > 0) {
       ref.syntaxWarning = (verifyFileSyntax(files) || []).map((w) => `${w.file}: ${w.error}`).join('; ')
-      await writeCandidateWorkspace(cwd, i + 1, files)
+      await writeCandidateWorkspace(cwd, i + 1, files, { runId })
     }
   }
-
   if (signal?.aborted) {
-    await cleanMoaWorkspaces(cwd)
+    await cleanMoaWorkspaces(cwd, { runId })
     return { error: new Error('Turn aborted') }
   }
-
   // 5b. Test Execution Gate
   await executeTestGateForCandidates({
     cwd,
     referenceOutputs,
     preset,
-    options: { testGateEnabled, testCommand, execFn },
+    options: { testGateEnabled, testCommand, execFn, runId },
     onProgress,
   })
-
   // 6. Questionnaire synthesis branch
   if (needsQuestions) {
     if (typeof onProgress === 'function') {
@@ -248,12 +232,10 @@ export async function runMoAPipeline({
       logger.warn('[dsh-moa] Questionnaire synthesis failed, proceeding with fallback questions:', err)
       questionsContent = `### Clarification of Requirements: "${userPrompt}"\n\n1. **Architecture & Scope**: Single-file deliverable or multi-module project structure?\n2. **Design & Style**: Minimalist, dark mode, or clean neutral theme?\n3. **Functional Priorities**: Core MVP or comprehensive extended implementation?\n\n*Reply with your preferences (e.g. "1, 2") or proceed with defaults.*`
     }
-
-    await cleanMoaWorkspaces(cwd)
+    await cleanMoaWorkspaces(cwd, { runId })
     const totalTokens = referenceOutputs.reduce((acc, r) => acc + (r.usage?.totalTokens || 0), 0) + qUsage.totalTokens
     const totalCostUsd = Number((referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + qUsage.costUsd).toFixed(5))
     const durationMs = Date.now() - startTime
-
     try {
       await recordMoaRunAsync({
         prompt: userPrompt,
@@ -271,7 +253,6 @@ export async function runMoAPipeline({
     } catch (histErr) {
       logger.warn('[dsh-moa] Failed to record questionnaire run in history:', histErr?.message || histErr)
     }
-
     return {
       kind: 'questions',
       content: questionsContent,
@@ -298,15 +279,15 @@ export async function runMoAPipeline({
   // 7. Fast Mode (1 candidate, bypass judge)
   if (isFastMode) {
     if (signal?.aborted) {
-      await cleanMoaWorkspaces(cwd)
+      await cleanMoaWorkspaces(cwd, { runId })
       return { error: new Error('Turn aborted') }
     }
     const single = successfulRefs[0]
     let promotedFiles = []
     if (single.files?.length > 0) {
-      promotedFiles = await promoteCandidateWorkspace(cwd, single.index, promoteOpts)
+      promotedFiles = await promoteCandidateWorkspace(cwd, single.index, { ...promoteOpts, runId })
     } else {
-      await cleanMoaWorkspaces(cwd)
+      await cleanMoaWorkspaces(cwd, { runId })
     }
 
     const livePreview = await createPromotedPreview(liveCanvas, cwd, promotedFiles, referenceOutputs)
@@ -358,7 +339,7 @@ export async function runMoAPipeline({
   }
 
   if (signal?.aborted) {
-    await cleanMoaWorkspaces(cwd)
+    await cleanMoaWorkspaces(cwd, { runId })
     return { error: new Error('Turn aborted') }
   }
 
@@ -393,7 +374,7 @@ export async function runMoAPipeline({
         if (r2Files.length > 0) {
           cand.files = r2Files
           cand.syntaxWarning = (verifyFileSyntax(r2Files) || []).map((w) => `${w.file}: ${w.error}`).join('; ')
-          await writeCandidateWorkspace(cwd, cand.index, r2Files)
+          await writeCandidateWorkspace(cwd, cand.index, r2Files, { runId })
         }
         if (typeof res === 'object' && res?.usage) {
           cand.usage.inputTokens = (cand.usage.inputTokens || 0) + (res.usage.inputTokens || 0)
@@ -411,7 +392,7 @@ export async function runMoAPipeline({
       cwd,
       referenceOutputs: successfulRefs,
       preset,
-      options: { testGateEnabled, testCommand, execFn },
+      options: { testGateEnabled, testCommand, execFn, runId },
       onProgress,
     })
   }
@@ -419,7 +400,7 @@ export async function runMoAPipeline({
   // 7c. Feature 2: Multi-Judge Panel & Consensus Voting
   let multiJudgeResult = null
   if (signal?.aborted) {
-    await cleanMoaWorkspaces(cwd)
+    await cleanMoaWorkspaces(cwd, { runId })
     return { error: new Error('Turn aborted') }
   }
 
@@ -508,7 +489,7 @@ export async function runMoAPipeline({
   }
 
   if (signal?.aborted) {
-    await cleanMoaWorkspaces(cwd)
+    await cleanMoaWorkspaces(cwd, { runId })
     return { error: new Error('Turn aborted') }
   }
 
@@ -527,15 +508,15 @@ export async function runMoAPipeline({
 
   const keepWorkspaces = allowCandidateOverride
   if (synthesizedFiles.length > 0) {
-    await writeCandidateWorkspace(cwd, 'curator-synthesis', synthesizedFiles)
-    promotedFiles = await promoteCandidateWorkspace(cwd, 'curator-synthesis', { ...promoteOpts, keepMoa: keepWorkspaces })
+    await writeCandidateWorkspace(cwd, 'curator-synthesis', synthesizedFiles, { runId })
+    promotedFiles = await promoteCandidateWorkspace(cwd, 'curator-synthesis', { ...promoteOpts, runId, keepMoa: keepWorkspaces })
   } else if (referenceOutputs[winningIndex - 1]?.files?.length > 0) {
-    promotedFiles = await promoteCandidateWorkspace(cwd, winningIndex, { ...promoteOpts, keepMoa: keepWorkspaces })
+    promotedFiles = await promoteCandidateWorkspace(cwd, winningIndex, { ...promoteOpts, runId, keepMoa: keepWorkspaces })
   } else if (successfulRefs[0]?.files?.length > 0) {
     const fallbackIdx = successfulRefs[0].index
-    promotedFiles = await promoteCandidateWorkspace(cwd, fallbackIdx, { ...promoteOpts, keepMoa: keepWorkspaces })
+    promotedFiles = await promoteCandidateWorkspace(cwd, fallbackIdx, { ...promoteOpts, runId, keepMoa: keepWorkspaces })
   } else if (!keepWorkspaces) {
-    await cleanMoaWorkspaces(cwd)
+    await cleanMoaWorkspaces(cwd, { runId })
   }
 
   const livePreview = await createPromotedPreview(liveCanvas, cwd, promotedFiles, referenceOutputs)

package/lib/moa-stream.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto'
 /**
  * Zero-latency Live Streaming Generator for MoA Turns
  */
@@ -11,6 +12,7 @@ import { runMoAPipeline } from './moa-runner.js'
  */
 export async function* streamMoATurn({ targetPreset, userPrompt, messages, callLlm, cwd, prices, historyFilePath, liveCanvas, webServerPort, timeMachineEngine, force }, options = {}) {
   const signal = options?.signal
+  const runId = options?.runId || null
   if (signal?.aborted) return
 
   const internalAbortCtrl = new AbortController()
@@ -69,7 +71,7 @@ export async function* streamMoATurn({ targetPreset, userPrompt, messages, callL
 
     while (!done || queue.length > 0) {
       if (combinedSignal.aborted) {
-        await cleanMoaWorkspaces(cwd)
+        await cleanMoaWorkspaces(cwd, runId ? { runId } : {})
         return
       }
 
@@ -96,7 +98,7 @@ export async function* streamMoATurn({ targetPreset, userPrompt, messages, callL
 
     const result = await pipelinePromise
     if (combinedSignal.aborted) {
-      await cleanMoaWorkspaces(cwd)
+      await cleanMoaWorkspaces(cwd, runId ? { runId } : {})
       return
     }
 
@@ -126,7 +128,7 @@ export async function* streamMoATurn({ targetPreset, userPrompt, messages, callL
   } finally {
     internalAbortCtrl.abort()
     if (!done) {
-      await cleanMoaWorkspaces(cwd).catch(() => {})
+      await cleanMoaWorkspaces(cwd, runId ? { runId } : {}).catch(() => {})
     }
   }
 }

package/lib/moa-test-gate.js

@@ -3,32 +3,47 @@ import fs from 'node:fs/promises'
 import fsSync from 'node:fs'
 import path from 'node:path'
 import { spawn } from 'node:child_process'
-import { assertPathContained } from './file-workspace.js'
+import { resolveCandidateFolder } from './file-workspace.js'
 import { bestEffort } from './best-effort.js'
 
+const MAX_CAPTURE_BYTES = 256 * 1024
+
+/**
+ * Returns a sanitized environment stripping sensitive tokens and secrets (#161).
+ */
+export function getScrubbedEnv(overrides = {}) {
+  const safeVars = new Set([
+    'PATH', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TMPDIR', 'TEMP', 'TMP',
+    'USER', 'LOGNAME', 'HOME', 'SHELL', 'TERM', 'NODE_ENV', 'SYSTEMROOT',
+    'WINDIR', 'COMSPEC', 'PATHEXT',
+  ])
+  const scrubbed = {}
+  for (const [key, val] of Object.entries(process.env)) {
+    if (!val || key.startsWith('MOA_')) continue
+    if (/(API_KEY|TOKEN|SECRET|PASSWORD|PASSWD|AUTH|CREDENTIAL|PRIVATE|KEY|ACCESS)/i.test(key)) {
+      continue
+    }
+    if (safeVars.has(key) || key.startsWith('LC_')) {
+      scrubbed[key] = val
+    }
+  }
+  return { ...scrubbed, ...overrides }
+}
+
 /**
  * Resolves the directory for candidate sandbox.
  */
-export function resolveCandidateDir(baseDir, candidateIndex) {
+export function resolveCandidateDir(baseDir, candidateIndex, options = {}) {
   if (!baseDir || candidateIndex === null || candidateIndex === undefined) return null
-  const targetStr = String(candidateIndex).trim()
-  const sanitizedTarget = targetStr.replace(/[^a-zA-Z0-9_-]/g, '')
-  const sub = /^\d+$/.test(sanitizedTarget) ? `candidate-${sanitizedTarget}` : (sanitizedTarget || 'candidate-1')
-  const moaRoot = path.join(baseDir, '.moa')
-  return assertPathContained(moaRoot, sub)
+  try {
+    return resolveCandidateFolder(baseDir, candidateIndex, options).candidateDir
+  } catch {
+    return null
+  }
 }
 
 /**
  * Executes a test command in a candidate sandbox or ephemeral test staging directory.
- *
- * @param {object} params
- * @param {string} params.cwd - Project root workspace directory
- * @param {number|string} params.candidateIndex - Index of candidate (1, 2, ...)
- * @param {string} params.testCommand - Shell command to execute (e.g. "npm test", "node --test")
- * @param {number} [params.timeoutMs=15000] - Execution timeout in ms
- * @param {number} [params.maxOutputChars=2000] - Maximum captured output chars
- * @param {function} [params.execFn] - Optional mock/test runner function
- * @returns {Promise<object|null>} Test result object or null if skipped
  */
 export async function runCandidateTestGate({
   cwd,
@@ -37,18 +52,14 @@ export async function runCandidateTestGate({
   timeoutMs = 15000,
   maxOutputChars = 2000,
   execFn = null,
+  runId = null,
 }) {
-  if (!cwd || !testCommand || typeof testCommand !== 'string') {
-    return null
-  }
-
+  if (!cwd || !testCommand || typeof testCommand !== 'string') return null
   const trimmedCmd = testCommand.trim()
   if (!trimmedCmd) return null
 
-  const candidateDir = resolveCandidateDir(cwd, candidateIndex)
-  if (!candidateDir || !fsSync.existsSync(candidateDir)) {
-    return null
-  }
+  const candidateDir = resolveCandidateDir(cwd, candidateIndex, { runId })
+  if (!candidateDir || !fsSync.existsSync(candidateDir)) return null
 
   const startTime = Date.now()
   let stageDir = null
@@ -66,13 +77,19 @@ export async function runCandidateTestGate({
           const rel = path.relative(cwd, src)
           if (!rel) return true
           const parts = rel.split(path.sep)
-          if (parts[0] === 'node_modules' || parts[0] === '.git' || parts[0] === '.moa') {
-            return false
-          }
-          return true
+          return parts[0] !== 'node_modules' && parts[0] !== '.git' && parts[0] !== '.moa'
         },
       })
 
+      // #162: Preserve ESM & CJS resolution by symlinking project node_modules
+      const baseNodeModules = path.join(cwd, 'node_modules')
+      const stageNodeModules = path.join(stageDir, 'node_modules')
+      if (fsSync.existsSync(baseNodeModules)) {
+        await bestEffort('symlink node_modules in test stage', () =>
+          fs.symlink(baseNodeModules, stageNodeModules, process.platform === 'win32' ? 'junction' : 'dir')
+        )
+      }
+
       await fs.cp(candidateDir, stageDir, { recursive: true })
       executionDir = stageDir
     }
@@ -98,22 +115,25 @@ export async function runCandidateTestGate({
       stderr = customRes?.stderr || ''
     } else {
       const nodePath = path.join(cwd, 'node_modules')
-      const env = {
-        ...process.env,
+      const env = getScrubbedEnv({
         MOA_CANDIDATE_INDEX: String(candidateIndex),
         MOA_CANDIDATE_DIR: candidateDir,
         MOA_BASE_DIR: cwd,
+        ...(runId ? { MOA_RUN_ID: String(runId) } : {}),
         NODE_PATH: process.env.NODE_PATH ? `${nodePath}:${process.env.NODE_PATH}` : nodePath,
-      }
+      })
 
       const runPromise = new Promise((resolve) => {
         let child
+        let timeoutHandle = null
+        let killEscalateHandle = null
+
         try {
           child = spawn(resolvedCmd, {
             cwd: executionDir,
             shell: true,
+            detached: process.platform !== 'win32',
             env,
-            timeout: timeoutMs,
           })
         } catch (spawnErr) {
           resolve({ exitCode: 1, stdout: '', stderr: spawnErr.message || String(spawnErr) })
@@ -122,15 +142,50 @@ export async function runCandidateTestGate({
 
         const outChunks = []
         const errChunks = []
+        let capturedBytes = 0
+
+        child.stdout?.on('data', (d) => {
+          if (capturedBytes < MAX_CAPTURE_BYTES) {
+            outChunks.push(d)
+            capturedBytes += d.length
+          }
+        })
+        child.stderr?.on('data', (d) => {
+          if (capturedBytes < MAX_CAPTURE_BYTES) {
+            errChunks.push(d)
+            capturedBytes += d.length
+          }
+        })
+
+        const killChild = (sig = 'SIGTERM') => {
+          if (!child || !child.pid) return
+          bestEffort('test-gate kill child process group', () => {
+            if (process.platform !== 'win32') {
+              process.kill(-child.pid, sig)
+            } else {
+              child.kill(sig)
+            }
+          })
+        }
 
-        child.stdout?.on('data', (d) => outChunks.push(d))
-        child.stderr?.on('data', (d) => errChunks.push(d))
+        if (timeoutMs > 0) {
+          timeoutHandle = setTimeout(() => {
+            killChild('SIGTERM')
+            killEscalateHandle = setTimeout(() => {
+              killChild('SIGKILL')
+            }, 1000)
+          }, timeoutMs)
+        }
 
         child.on('error', (err) => {
+          if (timeoutHandle) clearTimeout(timeoutHandle)
+          if (killEscalateHandle) clearTimeout(killEscalateHandle)
           resolve({ exitCode: 1, stdout: Buffer.concat(outChunks).toString('utf8'), stderr: err.message || String(err) })
         })
 
         child.on('close', (code, sig) => {
+          if (timeoutHandle) clearTimeout(timeoutHandle)
+          if (killEscalateHandle) clearTimeout(killEscalateHandle)
           const combinedErr = Buffer.concat(errChunks).toString('utf8')
           const finalErr = sig ? `${combinedErr}\nProcess terminated by signal ${sig}`.trim() : combinedErr
           resolve({
@@ -154,9 +209,7 @@ export async function runCandidateTestGate({
       : combinedOutput
 
     const passed = exitCode === 0
-    const summary = passed
-      ? `PASS (${durationMs}ms)`
-      : `FAIL (code ${exitCode}, ${durationMs}ms)`
+    const summary = passed ? `PASS (${durationMs}ms)` : `FAIL (code ${exitCode}, ${durationMs}ms)`
 
     return {
       candidateIndex,
@@ -199,12 +252,11 @@ export async function executeTestGateForCandidates({
 }) {
   const isEnabled = Boolean(options.testGateEnabled ?? preset.test_gate_enabled)
   const testCmd = options.testCommand || preset.test_command
-  if (!isEnabled || !testCmd || !cwd) {
-    return []
-  }
+  if (!isEnabled || !testCmd || !cwd) return []
 
   const timeoutMs = (preset.test_gate_timeout_sec || 15) * 1000
   const maxOutputChars = preset.test_gate_max_output_chars || 2000
+  const runId = options.runId || preset.runId
 
   if (typeof onProgress === 'function') {
     onProgress('🧪 *Test Execution Gate: Running test suite against candidate sandboxes...*\n')
@@ -221,6 +273,7 @@ export async function executeTestGateForCandidates({
       timeoutMs,
       maxOutputChars,
       execFn: options.execFn,
+      runId,
     })
 
     if (res) {
@@ -234,4 +287,4 @@ export async function executeTestGateForCandidates({
   }
 
   return results
-}
+}

package/lib/routes.js

@@ -323,7 +323,9 @@ ctx.effect(() => {
             return
           }
           const cwd = body?.cwd || process.cwd()
+          const runId = body?.runId
           const promotedFiles = await promoteCandidateWorkspace(cwd, candidateIndex, {
+            runId,
             keepMoa: true,
             port: ctx.webServer?.port,
             timeMachineEngine: ctx.get?.('timeMachineEngine') || ctx.timeMachineEngine,
@@ -359,8 +361,9 @@ ctx.effect(() => {
           const rawFile = u.searchParams.get('file') || ''
           const file = (rawFile && isSafeRelativePath(rawFile)) ? rawFile : ''
 
-          const fromFiles = await readCandidateFiles(cwd, from)
-          const toFiles = await readCandidateFiles(cwd, to)
+          const runId = u.searchParams.get('runId') || undefined
+          const fromFiles = await readCandidateFiles(cwd, from, { runId })
+          const toFiles = await readCandidateFiles(cwd, to, { runId })
 
           // Collect all unique file paths
           const allPaths = Array.from(new Set([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.37",
+  "version": "0.2.38",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",