@goodandready/dsh-moa 0.2.41 → 0.2.43

package/lib/moa-runner.js

@@ -18,7 +18,7 @@ export { parseWinnerIndex, parseRecommendedAssembler, parseMoACommand, stripOrSu
 export { estimateTokenCost, summarizeMoAUsage } from './pricing.js'
 export { REFERENCE_SYSTEM_PROMPT, callWithTransientRetry, runReferencesParallel } from './moa-candidates.js'
 export { executeTestGateForCandidates, runCandidateTestGate } from './moa-test-gate.js'
-export { streamMoATurn } from './moa-stream.js'
+export { streamMoATurn, streamPromoteTurn } from './moa-stream.js'
 /**
  * Executes the full Mixture of Agents pipeline.
  */
@@ -38,7 +38,8 @@ export async function runMoAPipeline({
   webServerPort = null, timeMachineEngine = null, timeMachineUrl = null,
   force = isTestEnvironment() ? true : false, checkpoint = true, checkpointFn = null, runId: customRunId = null,
 }) {
-  const promoteOpts = { webServerPort, timeMachineEngine, timeMachineUrl, force: Boolean(force), checkpoint, checkpointFn }
+  const runId = (customRunId && String(customRunId).trim()) || crypto.randomUUID()
+  const promoteOpts = { webServerPort, timeMachineEngine, timeMachineUrl, force: Boolean(force), checkpoint, checkpointFn, signal }
   if (signal?.aborted) return { error: new Error('Turn aborted') }
   const startTime = Date.now()
   // 1. Resolve configurations
@@ -58,7 +59,7 @@ export async function runMoAPipeline({
   const candidateRetries = 1, refTimeoutSec = typeof preset?.reference_timeout_sec === 'number' ? preset.reference_timeout_sec : 60
   const aggTimeoutSec = typeof preset?.aggregator_timeout_sec === 'number' ? preset.aggregator_timeout_sec : 180
   const isBlindEvaluation = Boolean(preset?.blind_evaluation), isPeerCritiqueEnabled = Boolean(preset?.peer_critique_enabled)
-  const allowCandidateOverride = Boolean(preset?.allow_candidate_override), runId = customRunId || null
+  const allowCandidateOverride = Boolean(preset?.allow_candidate_override)
   // Feature 6: Budget Guardrail check
   const budgetCheck = applyBudgetGuardrails({
     references: referenceModels,
@@ -229,6 +230,7 @@ export async function runMoAPipeline({
     const durationMs = Date.now() - startTime
     try {
       await recordMoaRunAsync({
+        cwd,
         prompt: userPrompt,
         preset: preset?.name || 'default',
         isRefinement,
@@ -274,57 +276,47 @@ export async function runMoAPipeline({
       return { error: new Error('Turn aborted') }
     }
     const single = successfulRefs[0]
-    let promotedFiles = []
+    let promotedFiles = [], promoteErr = null
     if (single.files?.length > 0) {
-      promotedFiles = await promoteCandidateWorkspace(cwd, single.index, { ...promoteOpts, runId })
-    } else {
+      try {
+        promotedFiles = await promoteCandidateWorkspace(cwd, single.index, { ...promoteOpts, runId, keepMoa: allowCandidateOverride })
+      } catch (e) { promoteErr = e }
+    } else if (!allowCandidateOverride) {
       await cleanMoaWorkspaces(cwd, { runId })
     }
+    if (signal?.aborted || promoteErr?.message?.includes('aborted') || promoteErr?.name === 'AbortError') {
+      if (!allowCandidateOverride) await cleanMoaWorkspaces(cwd, { runId })
+      return { error: new Error('Turn aborted') }
+    }
 
-    const livePreview = await createPromotedPreview(liveCanvas, cwd, promotedFiles, referenceOutputs)
+    const livePreview = await createPromotedPreview(liveCanvas, cwd, promotedFiles, referenceOutputs, { winningIndex: single.index })
     const totalTokens = single.usage?.totalTokens || 0
     const totalCostUsd = Number((single.costUsd || 0).toFixed(5))
     const durationMs = Date.now() - startTime
 
     try {
       await recordMoaRunAsync({
-        prompt: userPrompt,
-        preset: preset?.name || 'default',
-        isRefinement,
-        isFastMode: true,
-        candidates: candidatesForHistory(referenceOutputs),
-        aggregator: null,
-        winnerIndex: single.index,
-        winnerModel: single.label,
-        promotedFiles,
-        totalTokens,
-        totalCostUsd,
-        durationMs,
+        id: runId, cwd, prompt: userPrompt, preset: preset?.name || 'default',
+        isRefinement, isFastMode: true, candidates: candidatesForHistory(referenceOutputs),
+        aggregator: null, winnerIndex: single.index, winnerModel: single.label,
+        promotedFiles, totalTokens, totalCostUsd, durationMs,
       }, historyFilePath || undefined)
     } catch (histErr) {
       logger.warn('[dsh-moa] Failed to record fast synthesis run in history:', histErr?.message || histErr)
     }
 
     return {
-      kind: 'synthesis',
-      content: single.text,
-      aggregator: 'Fast Mode (Direct)',
-      references: referenceOutputs,
-      presetName: preset?.name || 'default',
-      isRefinement,
-      isFastMode: true,
-      winningIndex: single.index,
-      winnerModel: single.label,
-      promotedFiles,
+      kind: 'synthesis', content: single.text, aggregator: 'Fast Mode (Direct)',
+      references: referenceOutputs, presetName: preset?.name || 'default',
+      isRefinement, isFastMode: true, winningIndex: single.index,
+      winnerModel: single.label, promotedFiles, runId,
       ...(livePreview ? { liveCanvas: livePreview } : {}),
       usage: {
-        totalTokens,
-        totalCostUsd,
+        totalTokens, totalCostUsd,
         candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
         aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 },
       },
-      skippedFiles: collectedCtx?.skippedFiles || 0,
-      skippedList: collectedCtx?.skippedList || [],
+      skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [],
       durationMs,
     }
   }
@@ -500,19 +492,29 @@ export async function runMoAPipeline({
   let promotedFiles = []
 
   const keepWorkspaces = allowCandidateOverride
-  if (synthesizedFiles.length > 0) {
-    await writeCandidateWorkspace(cwd, 'curator-synthesis', synthesizedFiles, { runId })
-    promotedFiles = await promoteCandidateWorkspace(cwd, 'curator-synthesis', { ...promoteOpts, runId, keepMoa: keepWorkspaces })
-  } else if (referenceOutputs[winningIndex - 1]?.files?.length > 0) {
-    promotedFiles = await promoteCandidateWorkspace(cwd, winningIndex, { ...promoteOpts, runId, keepMoa: keepWorkspaces })
-  } else if (successfulRefs[0]?.files?.length > 0) {
-    const fallbackIdx = successfulRefs[0].index
-    promotedFiles = await promoteCandidateWorkspace(cwd, fallbackIdx, { ...promoteOpts, runId, keepMoa: keepWorkspaces })
-  } else if (!keepWorkspaces) {
-    await cleanMoaWorkspaces(cwd, { runId })
+  if (signal?.aborted) {
+    if (!keepWorkspaces) await cleanMoaWorkspaces(cwd, { runId })
+    return { error: new Error('Turn aborted') }
+  }
+  try {
+    if (synthesizedFiles.length > 0) {
+      await writeCandidateWorkspace(cwd, 'curator-synthesis', synthesizedFiles, { runId })
+      promotedFiles = await promoteCandidateWorkspace(cwd, 'curator-synthesis', { ...promoteOpts, runId, keepMoa: keepWorkspaces })
+    } else if (referenceOutputs[winningIndex - 1]?.files?.length > 0) {
+      promotedFiles = await promoteCandidateWorkspace(cwd, winningIndex, { ...promoteOpts, runId, keepMoa: keepWorkspaces })
+    } else if (successfulRefs[0]?.files?.length > 0) {
+      const fallbackIdx = successfulRefs[0].index
+      promotedFiles = await promoteCandidateWorkspace(cwd, fallbackIdx, { ...promoteOpts, runId, keepMoa: keepWorkspaces })
+    } else if (!keepWorkspaces) {
+      await cleanMoaWorkspaces(cwd, { runId })
+    }
+  } catch (promoteErr) {
+    if (!keepWorkspaces) await cleanMoaWorkspaces(cwd, { runId })
+    if (signal?.aborted || promoteErr?.message === 'Turn aborted') return { error: new Error('Turn aborted') }
+    throw promoteErr
   }
 
-  const livePreview = await createPromotedPreview(liveCanvas, cwd, promotedFiles, referenceOutputs)
+  const livePreview = await createPromotedPreview(liveCanvas, cwd, promotedFiles, referenceOutputs, { winningIndex, synthesizedFiles })
   const durationMs = Date.now() - startTime
   const usageSummary = summarizeMoAUsage(referenceOutputs, aggUsage, multiJudgeResult?.totalUsage)
   const winningRef = referenceOutputs[winningIndex - 1]
@@ -542,6 +544,7 @@ export async function runMoAPipeline({
   try {
     await recordMoaRunAsync({
       id: runId,
+      cwd,
       prompt: userPrompt,
       preset: preset?.name || 'default',
       isRefinement,
@@ -579,8 +582,7 @@ export async function runMoAPipeline({
     consensus: multiJudgeResult,
     ...(livePreview ? { liveCanvas: livePreview } : {}),
     usage: usageSummary,
-    skippedFiles: collectedCtx?.skippedFiles || 0,
-    skippedList: collectedCtx?.skippedList || [],
+    skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [],
     durationMs,
   }
 }

package/lib/moa-stream.js

@@ -3,7 +3,8 @@ import crypto from 'node:crypto'
  * Zero-latency Live Streaming Generator for MoA Turns
  */
 
-import { cleanMoaWorkspaces } from './file-workspace.js'
+import { cleanMoaWorkspaces, promoteCandidateWorkspace } from './file-workspace.js'
+import { isTestEnvironment, getMoaHistory } from './history.js'
 import { formatMoAResponse } from './moa-parser.js'
 import { runMoAPipeline } from './moa-runner.js'
 
@@ -56,6 +57,7 @@ export async function* streamMoATurn({ targetPreset, userPrompt, messages, callL
       timeMachineEngine,
       force,
       signal: combinedSignal,
+      runId,
     })
       .catch((err) => ({ error: err }))
       .finally(() => {
@@ -132,3 +134,59 @@ export async function* streamMoATurn({ targetPreset, userPrompt, messages, callL
     }
   }
 }
+
+/**
+ * Streams a /moa promote candidate turn directly to chat with zero LLM calls (#177).
+ */
+export async function* streamPromoteTurn({ runId, candidateIndex, cwd, webServerPort, timeMachineEngine, force = isTestEnvironment() }, options = {}) {
+  const signal = options?.signal
+  if (signal?.aborted) return
+
+  yield { type: 'block-start', index: 0, blockType: 'text' }
+
+  if (typeof candidateIndex !== 'number' || isNaN(candidateIndex) || candidateIndex < 1) {
+    const errText = '⚠️ **MoA Promote Error**: Valid candidate index required (>= 1).'
+    yield { type: 'text-delta', index: 0, text: errText }
+    yield { type: 'block-end', index: 0, block: { type: 'text', text: errText } }
+    yield { type: 'finish', reason: { kind: 'stop' } }
+    return
+  }
+
+  try {
+    const effectiveRunId = runId || getMoaHistory(1, 0).runs[0]?.id || null
+    yield { type: 'text-delta', index: 0, text: `🔄 *Promoting candidate ${candidateIndex}${effectiveRunId ? ` for run \`${effectiveRunId}\`` : ''}...*\n\n` }
+
+    const promotedFiles = await promoteCandidateWorkspace(cwd, candidateIndex, {
+      runId: effectiveRunId,
+      keepMoa: true,
+      port: webServerPort,
+      timeMachineEngine,
+      force: Boolean(force || options?.force),
+    })
+
+    if (!promotedFiles || promotedFiles.length === 0) {
+      const noFilesText = `⚠️ **MoA Promote Notice**: No candidate files found for candidate ${candidateIndex}${effectiveRunId ? ` in run \`${effectiveRunId}\`` : ''}. Workspace may have expired or run does not exist.`
+      yield { type: 'text-delta', index: 0, text: noFilesText }
+      yield { type: 'block-end', index: 0, block: { type: 'text', text: noFilesText } }
+      yield { type: 'finish', reason: { kind: 'stop' } }
+      return
+    }
+
+    const fileList = promotedFiles.map((f) => `\`${f}\``).join(', ')
+    const checkpointId = promotedFiles.checkpoint || null
+    let successMsg = `✅ **MoA Candidate ${candidateIndex} promoted successfully!**\n\n`
+    successMsg += `> 📦 **Files applied to workspace**: ${fileList}\n`
+    if (checkpointId) {
+      successMsg += `> 🛡️ **Time Machine Checkpoint**: \`${checkpointId}\`\n`
+    }
+
+    yield { type: 'text-delta', index: 0, text: successMsg }
+    yield { type: 'block-end', index: 0, block: { type: 'text', text: successMsg } }
+    yield { type: 'finish', reason: { kind: 'stop' } }
+  } catch (err) {
+    const errText = `⚠️ **MoA Promote Failed**: ${err?.message || String(err)}`
+    yield { type: 'text-delta', index: 0, text: errText }
+    yield { type: 'block-end', index: 0, block: { type: 'text', text: errText } }
+    yield { type: 'finish', reason: { kind: 'stop' } }
+  }
+}

package/lib/moa-test-gate.js

@@ -115,12 +115,23 @@ export async function runCandidateTestGate({
       stderr = customRes?.stderr || ''
     } else {
       const nodePath = path.join(cwd, 'node_modules')
+      const allowedReads = [
+        executionDir,
+        cwd,
+        ...(candidateDir && candidateDir !== executionDir ? [candidateDir] : []),
+        ...(process.platform === 'win32'
+          ? [process.env.SYSTEMROOT || 'C:\\Windows', path.dirname(process.execPath)]
+          : ['/usr', '/lib', '/lib64', '/etc', path.resolve(path.dirname(process.execPath), '..'), process.env.HOME ? path.join(process.env.HOME, '.npmrc') : null]),
+      ].filter(Boolean)
+      const permOpts = `--permission ${allowedReads.map((p) => `--allow-fs-read=${p}`).join(' ')} --allow-fs-write=${executionDir} --allow-child-process`
+
       const env = getScrubbedEnv({
         MOA_CANDIDATE_INDEX: String(candidateIndex),
         MOA_CANDIDATE_DIR: candidateDir,
         MOA_BASE_DIR: cwd,
         ...(runId ? { MOA_RUN_ID: String(runId) } : {}),
         NODE_PATH: process.env.NODE_PATH ? `${nodePath}:${process.env.NODE_PATH}` : nodePath,
+        NODE_OPTIONS: process.env.NODE_OPTIONS ? `${process.env.NODE_OPTIONS} ${permOpts}` : permOpts,
       })
 
       const runPromise = new Promise((resolve) => {

package/lib/routes.js

@@ -356,7 +356,11 @@ ctx.effect(() => {
         }
         try {
           const u = new URL(req.url, 'http://localhost')
-          const cwd = u.searchParams.get('cwd') || process.cwd()
+          const rawRunId = u.searchParams.get('runId')
+          const latestRun = (!rawRunId || rawRunId === 'latest' || rawRunId === 'active') ? getMoaHistory(1, 0).runs[0] : null
+          const runId = (rawRunId && rawRunId !== 'latest' && rawRunId !== 'active') ? rawRunId : latestRun?.id
+          const run = runId ? getMoaRunById(runId) : null
+          const cwd = run?.cwd || latestRun?.cwd || u.searchParams.get('cwd') || process.cwd()
           const sanitizeTarget = (val, def) => {
             const clean = String(val || '').trim().replace(/[^a-zA-Z0-9_-]/g, '')
             return clean || def
@@ -366,7 +370,6 @@ ctx.effect(() => {
           const rawFile = u.searchParams.get('file') || ''
           const file = (rawFile && isSafeRelativePath(rawFile)) ? rawFile : ''
 
-          const runId = u.searchParams.get('runId') || undefined
           const fromFiles = await readCandidateFiles(cwd, from, { runId })
           const toFiles = await readCandidateFiles(cwd, to, { runId })
 
@@ -510,11 +513,14 @@ ctx.effect(() => {
           const raw = await readBody(req)
           const body = JSON.parse(raw || '{}')
           const prompt = body?.prompt || ''
+          const activePreset = (cfg.presets || []).find((p) => p.name === (cfg.default_preset || 'default')) || cfg.presets?.[0]
+          const routingModel = (activePreset?.smart_routing_model?.model && activePreset.smart_routing_model)
+            || (cfg.smart_routing_model?.model && cfg.smart_routing_model) || activePreset?.smart_routing_model || cfg.smart_routing_model
           const result = await resolvePresetForPrompt({
             prompt,
             presets: cfg.presets || [],
             defaultPreset: cfg.default_preset || 'default',
-            routingModel: cfg.smart_routing_model,
+            routingModel,
             callLlm,
             enabled: cfg.enabled !== false,
           })
@@ -574,6 +580,7 @@ ctx.effect(() => {
             timeMachineEngine: timeMachineEngine || ctx.reflect?.get?.('timeMachineEngine', false),
             timeMachineUrl: payload.timeMachineUrl, force: payload.force,
             checkpoint: payload.checkpoint, checkpointFn: payload.checkpointFn,
+            runId: payload.runId,
           })
 
           if (result?.skippedFiles > 0) {

package/lib/updater.js

@@ -43,18 +43,39 @@ export function isTrustedUpdateRequest(request) {
 
 /** General safe write check for plugin write endpoints (CSRF / Cross-Site protection) */
 export function isSafeWriteRequest(request) {
+  const remote = request?.socket?.remoteAddress || request?.connection?.remoteAddress;
+  const isLoop = !remote || isLoopback(remote);
+
   const site = header(request, 'sec-fetch-site');
   if (site === 'cross-site') return false;
+
   const origin = header(request, 'origin');
   const host = header(request, 'host');
+
+  // If non-loopback caller, require valid same-origin browser proof
+  if (!isLoop) {
+    if (!origin || !host) return false;
+    if (site && site !== 'same-origin' && site !== 'none') return false;
+  }
+
+  // Same-site without matching origin is rejected regardless of remote
+  if (site === 'same-site') {
+    if (!origin || !host) return false;
+  }
+
   if (origin) {
+    if (origin === 'null') return false;
     try {
       const url = new URL(origin);
       if (host && url.host !== host) return false;
+      if (!isLoop) {
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
+      }
     } catch {
       return false;
     }
   }
+
   return true;
 }
 
@@ -353,6 +374,8 @@ export function registerPluginUpdater(ctx, options) {
           }
           await installExact(target, `${options.packageName}@${before.latestVersion}`, options);
           json(response, 200, {
+            ok: true,
+            updated: true,
             ...before,
             updatedVersion: before.latestVersion,
             restartRequired: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.41",
+  "version": "0.2.43",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",