@goodandready/dsh-moa 0.2.43 → 0.2.44

package/lib/client.js

@@ -2575,7 +2575,7 @@ window.__ModuleLoader__.load({
             }
           })
           .catch((err) => {
-            setSaveStatus(`Error: ${err.message || err}`)
+            setSaveStatus((t('status.error_saving') || 'Error saving: ') + (err?.message || String(err)))
           })
       }
 

package/lib/file-workspace.js

@@ -78,16 +78,6 @@ export function resolveCandidateFolder(baseDir, candidateTarget, options = {}) {
   const sub = /^\d+$/.test(sanitizedTarget) ? `candidate-${sanitizedTarget}` : (sanitizedTarget || 'candidate-1')
   const rawRunId = typeof options === 'string' ? options : options?.runId
   const safeRunId = rawRunId ? String(rawRunId).trim().replace(/[^a-zA-Z0-9_-]/g, '') : null
-  const moaPath = path.resolve(baseDir, '.moa')
-  try {
-    const lst = fsSync.lstatSync(moaPath)
-    if (lst.isSymbolicLink()) {
-      const realMoa = fsSync.realpathSync(moaPath), realBase = fsSync.realpathSync(path.resolve(baseDir))
-      if (realMoa !== realBase && !realMoa.startsWith(realBase + path.sep)) fsSync.unlinkSync(moaPath)
-    }
-  } catch (err) {
-    if (err?.code !== 'ENOENT') throw err
-  }
   const moaRoot = assertPathContained(baseDir, '.moa')
   const runRoot = safeRunId ? assertPathContained(moaRoot, safeRunId) : moaRoot
   return { moaRoot, runRoot, safeRunId, sub, candidateDir: assertPathContained(runRoot, sub) }

package/lib/moa-budget.js

@@ -40,6 +40,7 @@ export function applyBudgetGuardrails({
   action = 'trim', // 'trim' | 'abort'
   prices = {},
   promptLength = 1000,
+  projectContext = '',
   messages = [],
   maxTokens = 2048,
   peerCritiqueEnabled = false,
@@ -57,6 +58,9 @@ export function applyBudgetGuardrails({
 
   // Calculate full input tokens from userPrompt length + messages context
   let contextChars = Number(promptLength) || 1000
+  if (typeof projectContext === 'string' && projectContext.length > 0 && !String(promptLength).includes(String(projectContext.length))) {
+    contextChars += projectContext.length
+  }
   if (Array.isArray(messages) && messages.length > 0) {
     for (const m of messages) {
       if (typeof m?.content === 'string') {

package/lib/moa-candidates.js

@@ -122,7 +122,6 @@ export async function runReferencesParallel(references, messages, options = {},
             })
             reject(new Error(`Timeout after ${Math.round(timeoutMs / 1000)}s`))
           }, timeoutMs)
-          candidateTimer?.unref?.()
         })
 
         const res = await Promise.race([callPromise, timeoutPromise])

package/lib/moa-llm.js

@@ -139,3 +139,14 @@ export function createLlmCaller(ctx) {
     }
   }
 }
+
+
+export function callConfigEquals(a, b) {
+  if (!a || !b) return false
+  if (a.provider !== b.provider) return false
+  if (a.model !== b.model) return false
+  if (a.temperature !== b.temperature) return false
+  if (a.maxTokens !== b.maxTokens) return false
+  if (a.reasoningEffort !== b.reasoningEffort) return false
+  return true
+}

package/lib/moa-runner.js

@@ -60,14 +60,33 @@ export async function runMoAPipeline({
   const aggTimeoutSec = typeof preset?.aggregator_timeout_sec === 'number' ? preset.aggregator_timeout_sec : 180
   const isBlindEvaluation = Boolean(preset?.blind_evaluation), isPeerCritiqueEnabled = Boolean(preset?.peer_critique_enabled)
   const allowCandidateOverride = Boolean(preset?.allow_candidate_override)
-  // Feature 6: Budget Guardrail check
+  // 1. Collect project context for refinement tasks
+  const collectedCtx = await collectProjectContext(cwd, 16000)
+  const isRefinement = Boolean(collectedCtx?.files?.length > 0 && isRefinementTask(userPrompt, collectedCtx.files))
+  let projectContext = ''
+  if (collectedCtx?.skippedFiles > 0 && typeof onProgress === 'function') {
+    const preview = collectedCtx.skippedList.slice(0, 3).join(', ')
+    const more = collectedCtx.skippedList.length > 3 ? ` (+${collectedCtx.skippedList.length - 3})` : ''
+    onProgress(`⚠️ *Workspace scan note: ${collectedCtx.skippedFiles} file(s) skipped (${preview}${more})*\n`)
+  }
+  if (isRefinement) {
+    if (typeof onProgress === 'function') {
+      onProgress('🔍 *Reading project files for refinement context...*\n')
+    }
+    projectContext = formatProjectContext(collectedCtx.files, {
+      skippedFiles: collectedCtx.skippedFiles,
+      skippedList: collectedCtx.skippedList,
+    })
+  }
+  // 2. Budget Guardrail check
   const budgetCheck = applyBudgetGuardrails({
     references: referenceModels,
     enabled: preset?.budget_guard_enabled,
     maxBudgetUsd: preset?.max_budget_usd,
     action: preset?.budget_action || 'trim',
     prices,
-    promptLength: userPrompt?.length || 1000,
+    promptLength: (userPrompt?.length || 1000) + (projectContext ? projectContext.length : 0),
+    projectContext,
     messages,
     maxTokens,
     peerCritiqueEnabled: isPeerCritiqueEnabled,
@@ -75,20 +94,12 @@ export async function runMoAPipeline({
     judgeModels: preset?.multi_judge_enabled ? preset?.judge_models : [],
   })
   if (!budgetCheck.allowed) {
-    return {
-      kind: 'failure',
-      content: `🛑 Budget Guardrail Abort: ${budgetCheck.reason}`,
-      aggregator: slotLabel(primaryJudge),
-      references: [],
-      presetName: preset?.name || 'default',
-      isRefinement: false,
-      isFastMode,
-      winningIndex: 0,
-      winnerModel: 'none',
-      promotedFiles: [],
+    return {      kind: 'failure', content: `🛑 Budget Guardrail Abort: ${budgetCheck.reason}`,
+      aggregator: slotLabel(primaryJudge), references: [], presetName: preset?.name || 'default',
+      isRefinement, isFastMode, winningIndex: 0, winnerModel: 'none', promotedFiles: [],
       usage: { totalTokens: 0, totalCostUsd: 0, candidates: [], aggregator: { totalTokens: 0, costUsd: 0 } },
-      skippedFiles: 0,
-      skippedList: [],
+      skippedFiles: collectedCtx?.skippedFiles || 0,
+      skippedList: collectedCtx?.skippedList || [],
       durationMs: Date.now() - startTime,
     }
   }
@@ -96,24 +107,6 @@ export async function runMoAPipeline({
   if (budgetCheck.action === 'trim' && typeof onProgress === 'function') {
     onProgress(`✂️ *${budgetCheck.reason}*\n`)
   }
-  // 2. Collect project context for refinement tasks
-  const collectedCtx = await collectProjectContext(cwd, 16000)
-  const isRefinement = Boolean(collectedCtx?.files?.length > 0 && isRefinementTask(userPrompt, collectedCtx.files))
-  let projectContext = ''
-  if (collectedCtx?.skippedFiles > 0 && typeof onProgress === 'function') {
-    const preview = collectedCtx.skippedList.slice(0, 3).join(', ')
-    const more = collectedCtx.skippedList.length > 3 ? ` (+${collectedCtx.skippedList.length - 3})` : ''
-    onProgress(`⚠️ *Workspace scan note: ${collectedCtx.skippedFiles} file(s) skipped (${preview}${more})*\n`)
-  }
-  if (isRefinement) {
-    if (typeof onProgress === 'function') {
-      onProgress('🔍 *Reading project files for refinement context...*\n')
-    }
-    projectContext = formatProjectContext(collectedCtx.files, {
-      skippedFiles: collectedCtx.skippedFiles,
-      skippedList: collectedCtx.skippedList,
-    })
-  }
   // 3. Build prompts & Feature 8 multi-turn context
   const priorTurnBaseline = preset?.multi_turn_enabled !== false ? extractPriorTurnBaseline(messages) : null
   const prunedHistory = preset?.multi_turn_enabled !== false ? pruneMultiTurnMessages(messages) : messages
@@ -284,9 +277,21 @@ export async function runMoAPipeline({
     } else if (!allowCandidateOverride) {
       await cleanMoaWorkspaces(cwd, { runId })
     }
-    if (signal?.aborted || promoteErr?.message?.includes('aborted') || promoteErr?.name === 'AbortError') {
+    if (promoteErr) {
       if (!allowCandidateOverride) await cleanMoaWorkspaces(cwd, { runId })
-      return { error: new Error('Turn aborted') }
+      if (signal?.aborted || promoteErr?.message?.includes('aborted') || promoteErr?.name === 'AbortError' || promoteErr?.message === 'Turn aborted') {
+        return { error: new Error('Turn aborted') }
+      }
+      return {        kind: 'failure', error: promoteErr,
+        content: '🛑 Checkpoint or Promotion Failure: ' + (promoteErr?.message || String(promoteErr)),
+        aggregator: 'Fast Mode (Direct)', references: referenceOutputs,
+        presetName: preset?.name || 'default', isRefinement, isFastMode: true,
+        winningIndex: single.index, winnerModel: single.label, promotedFiles: [], runId,
+        usage: { totalTokens: 0, totalCostUsd: 0, candidates: [], aggregator: { totalTokens: 0, costUsd: 0 } },
+        skippedFiles: collectedCtx?.skippedFiles || 0,
+        skippedList: collectedCtx?.skippedList || [],
+        durationMs: Date.now() - startTime,
+      }
     }
 
     const livePreview = await createPromotedPreview(liveCanvas, cwd, promotedFiles, referenceOutputs, { winningIndex: single.index })

package/lib/moa-test-gate.js

@@ -121,9 +121,9 @@ export async function runCandidateTestGate({
         ...(candidateDir && candidateDir !== executionDir ? [candidateDir] : []),
         ...(process.platform === 'win32'
           ? [process.env.SYSTEMROOT || 'C:\\Windows', path.dirname(process.execPath)]
-          : ['/usr', '/lib', '/lib64', '/etc', path.resolve(path.dirname(process.execPath), '..'), process.env.HOME ? path.join(process.env.HOME, '.npmrc') : null]),
+          : ['/usr', '/lib', '/lib64', '/etc', path.resolve(path.dirname(process.execPath), '..')]),
       ].filter(Boolean)
-      const permOpts = `--permission ${allowedReads.map((p) => `--allow-fs-read=${p}`).join(' ')} --allow-fs-write=${executionDir} --allow-child-process`
+      const permOpts = `--permission ${allowedReads.map((p) => `--allow-fs-read=${p}`).join(' ')} --allow-fs-write=${executionDir}`
 
       const env = getScrubbedEnv({
         MOA_CANDIDATE_INDEX: String(candidateIndex),
@@ -134,6 +134,31 @@ export async function runCandidateTestGate({
         NODE_OPTIONS: process.env.NODE_OPTIONS ? `${process.env.NODE_OPTIONS} ${permOpts}` : permOpts,
       })
 
+      const allowedRoots = [executionDir, cwd, ...(candidateDir && candidateDir !== executionDir ? [candidateDir] : [])]
+      const cmdTokens = resolvedCmd.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []
+      for (const rawToken of cmdTokens) {
+        const token = rawToken.replace(/^["']|["']$/g, '')
+        if (path.isAbsolute(token)) {
+          if (/^\/(usr\/(bin|lib|include)|bin|lib|lib64|etc)/.test(token) && !/\.(txt|json|env|npmrc|key|ssh|md)/i.test(token)) {
+            continue
+          }
+          const real = path.resolve(token)
+          const allowed = allowedRoots.some((d) => d && (real === d || real.startsWith(d + path.sep)))
+          if (!allowed) {
+            const durationMs = Date.now() - startTime
+            return {
+              candidateIndex,
+              passed: false,
+              exitCode: 1,
+              durationMs,
+              command: resolvedCmd,
+              output: 'Access denied: test command specifies path outside workspace sandbox',
+              summary: `FAIL (code 1, ${durationMs}ms)`,
+            }
+          }
+        }
+      }
+
       const runPromise = new Promise((resolve) => {
         let child
         let timeoutHandle = null

package/lib/routes.js

@@ -2,12 +2,7 @@
  * DeepSeek Harness Mixture of Agents (MoA) — HTTP Route Handlers
  */
 
-import {
-  getMoaHistory,
-  getMoaLeaderboard,
-  getMoaRunById,
-  exportMoaHistory,
-} from './history.js'
+import { getMoaHistory, getMoaLeaderboard, getMoaRunById, exportMoaHistory } from './history.js'
 import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff, isSafeRelativePath } from './file-workspace.js'
 import { isSafeWriteRequest } from './updater.js'
 import { runMoAPipeline } from './moa-runner.js'
@@ -18,10 +13,7 @@ let _modelsCache = { timestamp: 0, models: [] }
 const MODELS_CACHE_TTL = 60 * 1000
 
 function writeJson(res, status, body) {
-  res.writeHead(status, {
-    'Content-Type': 'application/json; charset=utf-8',
-    'Cache-Control': 'no-store',
-  })
+  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' })
   res.end(JSON.stringify(body))
 }
 
@@ -30,10 +22,7 @@ function readBody(req) {
     let acc = ''
     req.on('data', (chunk) => {
       acc += chunk
-      if (acc.length > 5 * 1024 * 1024) {
-        req.destroy()
-        reject(new Error('Payload Too Large'))
-      }
+      if (acc.length > 5 * 1024 * 1024) { req.destroy(); reject(new Error('Payload Too Large')) }
     })
     req.on('end', () => resolve(acc))
     req.on('error', reject)
@@ -587,6 +576,11 @@ ctx.effect(() => {
             ctx.logger?.warn?.(`[dsh-moa] Workspace scan skipped ${result.skippedFiles} file(s): ${result.skippedList.join(', ')}`)
           }
 
+          if (result?.error) {
+            writeJson(res, 500, { ok: false, error: result.error?.message || String(result.error) })
+            return
+          }
+
           writeJson(res, 200, { ok: true, ...result })
         } catch (err) {
           writeJson(res, 500, { ok: false, error: err?.message || String(err) })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.43",
+  "version": "0.2.44",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",