@goodandready/dsh-moa 0.2.40 → 0.2.42

package/lib/routes.js

@@ -356,7 +356,9 @@ ctx.effect(() => {
         }
         try {
           const u = new URL(req.url, 'http://localhost')
-          const cwd = u.searchParams.get('cwd') || process.cwd()
+          const runId = u.searchParams.get('runId') || undefined
+          const run = runId ? getMoaRunById(runId) : null
+          const cwd = run?.cwd || u.searchParams.get('cwd') || process.cwd()
           const sanitizeTarget = (val, def) => {
             const clean = String(val || '').trim().replace(/[^a-zA-Z0-9_-]/g, '')
             return clean || def
@@ -366,7 +368,6 @@ ctx.effect(() => {
           const rawFile = u.searchParams.get('file') || ''
           const file = (rawFile && isSafeRelativePath(rawFile)) ? rawFile : ''
 
-          const runId = u.searchParams.get('runId') || undefined
           const fromFiles = await readCandidateFiles(cwd, from, { runId })
           const toFiles = await readCandidateFiles(cwd, to, { runId })
 

package/lib/updater.js

@@ -43,18 +43,39 @@ export function isTrustedUpdateRequest(request) {
 
 /** General safe write check for plugin write endpoints (CSRF / Cross-Site protection) */
 export function isSafeWriteRequest(request) {
+  const remote = request?.socket?.remoteAddress || request?.connection?.remoteAddress;
+  const isLoop = !remote || isLoopback(remote);
+
   const site = header(request, 'sec-fetch-site');
   if (site === 'cross-site') return false;
+
   const origin = header(request, 'origin');
   const host = header(request, 'host');
+
+  // If non-loopback caller, require valid same-origin browser proof
+  if (!isLoop) {
+    if (!origin || !host) return false;
+    if (site && site !== 'same-origin' && site !== 'none') return false;
+  }
+
+  // Same-site without matching origin is rejected regardless of remote
+  if (site === 'same-site') {
+    if (!origin || !host) return false;
+  }
+
   if (origin) {
+    if (origin === 'null') return false;
     try {
       const url = new URL(origin);
       if (host && url.host !== host) return false;
+      if (!isLoop) {
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
+      }
     } catch {
       return false;
     }
   }
+
   return true;
 }
 
@@ -353,6 +374,8 @@ export function registerPluginUpdater(ctx, options) {
           }
           await installExact(target, `${options.packageName}@${before.latestVersion}`, options);
           json(response, 200, {
+            ok: true,
+            updated: true,
             ...before,
             updatedVersion: before.latestVersion,
             restartRequired: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.40",
+  "version": "0.2.42",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",