@goodandready/dsh-moa 0.2.43 → 0.2.45

package/lib/client.js

@@ -2575,7 +2575,7 @@ window.__ModuleLoader__.load({
             }
           })
           .catch((err) => {
-            setSaveStatus(`Error: ${err.message || err}`)
+            setSaveStatus((t('status.error_saving') || 'Error saving: ') + (err?.message || String(err)))
           })
       }
 

package/lib/file-workspace.js

@@ -78,16 +78,6 @@ export function resolveCandidateFolder(baseDir, candidateTarget, options = {}) {
   const sub = /^\d+$/.test(sanitizedTarget) ? `candidate-${sanitizedTarget}` : (sanitizedTarget || 'candidate-1')
   const rawRunId = typeof options === 'string' ? options : options?.runId
   const safeRunId = rawRunId ? String(rawRunId).trim().replace(/[^a-zA-Z0-9_-]/g, '') : null
-  const moaPath = path.resolve(baseDir, '.moa')
-  try {
-    const lst = fsSync.lstatSync(moaPath)
-    if (lst.isSymbolicLink()) {
-      const realMoa = fsSync.realpathSync(moaPath), realBase = fsSync.realpathSync(path.resolve(baseDir))
-      if (realMoa !== realBase && !realMoa.startsWith(realBase + path.sep)) fsSync.unlinkSync(moaPath)
-    }
-  } catch (err) {
-    if (err?.code !== 'ENOENT') throw err
-  }
   const moaRoot = assertPathContained(baseDir, '.moa')
   const runRoot = safeRunId ? assertPathContained(moaRoot, safeRunId) : moaRoot
   return { moaRoot, runRoot, safeRunId, sub, candidateDir: assertPathContained(runRoot, sub) }
@@ -264,6 +254,18 @@ export async function writeCandidateWorkspace(baseDir, candidateIndex, files = [
   }
 }
 
+export function isLoopbackUrl(urlStr) {
+  if (!urlStr || typeof urlStr !== 'string') return false
+  try {
+    const u = new URL(urlStr)
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') return false
+    const h = u.hostname.replace(/^\[|\]$/g, '')
+    return h === 'localhost' || h === '127.0.0.1' || h === '::1' || /^127\.\d+\.\d+\.\d+$/.test(h)
+  } catch {
+    return false
+  }
+}
+
 /**
  * Best-effort integration with dsh-time-machine to create a shadow Git checkpoint
  * before candidate promotion overwrites files in the project workspace.
@@ -271,8 +273,7 @@ export async function writeCandidateWorkspace(baseDir, candidateIndex, files = [
 export async function createPrePromotionCheckpoint(baseDir, candidateTarget, options = {}) {
   if (!baseDir || options.checkpoint === false) return null
   if (typeof options.checkpointFn === 'function') {
-    const res = await bestEffort('custom checkpointFn', () => options.checkpointFn(baseDir, candidateTarget))
-    return res || null
+    return (await bestEffort('custom checkpointFn', () => options.checkpointFn(baseDir, candidateTarget))) || null
   }
 
   const label = options.checkpointLabel || `moa-pre-promotion: candidate-${candidateTarget}`
@@ -289,6 +290,11 @@ export async function createPrePromotionCheckpoint(baseDir, candidateTarget, opt
     return null
   }
 
+  if (options.timeMachineUrl && !isLoopbackUrl(options.timeMachineUrl)) {
+    logger.warn(`[dsh-moa] Blocked non-loopback timeMachineUrl: ${options.timeMachineUrl}`)
+    return null
+  }
+
   const endpoint = options.timeMachineUrl || `http://127.0.0.1:${port}/dsh-time-machine/create`
   const snap = await bestEffort('dsh-time-machine pre-promotion checkpoint', async () => {
     const res = await fetch(endpoint, {
@@ -337,9 +343,7 @@ async function doPromoteCandidateWorkspace(baseDir, winningIndex, options = { ke
   try {
     const entries = await getFilesRecursively(winningDir)
     if (entries.length === 0) {
-      if (!options.keepMoa) {
-        await bestEffort('clean empty candidate folder', () => fs.rm(cleanupTarget, { recursive: true, force: true }))
-      }
+      if (!options.keepMoa) await bestEffort('clean empty candidate folder', () => fs.rm(cleanupTarget, { recursive: true, force: true }))
       return []
     }
 
@@ -500,8 +504,7 @@ export async function readCandidateFiles(baseDir, candidateTarget, options = {})
   if (!baseDir || candidateTarget === undefined || candidateTarget === null) return []
   let targetDir
   try {
-    const resolved = resolveCandidateFolder(baseDir, candidateTarget, options)
-    targetDir = resolved.candidateDir
+    targetDir = resolveCandidateFolder(baseDir, candidateTarget, options).candidateDir
   } catch {
     return []
   }
@@ -518,9 +521,7 @@ export async function readCandidateFiles(baseDir, candidateTarget, options = {})
         const st = await fs.lstat(fullPath)
         if (st.isSymbolicLink()) {
           const realFile = await fs.realpath(fullPath)
-          if (realFile !== realTarget && !realFile.startsWith(realTarget + path.sep)) {
-            continue
-          }
+          if (realFile !== realTarget && !realFile.startsWith(realTarget + path.sep)) continue
         }
         const content = await fs.readFile(fullPath, 'utf8')
         result.push({ relativePath: rel, content, size: Buffer.byteLength(content, 'utf8') })
@@ -555,25 +556,22 @@ export function computeLineDiff(oldText = '', newText = '') {
     newEnd--
   }
 
-  const prefixItems = []
-  for (let k = 0; k < start; k++) prefixItems.push({ type: 'same', line: oldLines[k], oldNum: k + 1, newNum: k + 1 })
-
-  const suffixItems = []
+  const prefixItems = oldLines.slice(0, start).map((line, k) => ({ type: 'same', line, oldNum: k + 1, newNum: k + 1 }))
   const suffixLen = (n - 1) - oldEnd
-  for (let k = 0; k < suffixLen; k++) {
-    suffixItems.push({ type: 'same', line: oldLines[oldEnd + 1 + k], oldNum: oldEnd + 2 + k, newNum: newEnd + 2 + k })
-  }
+  const suffixItems = oldLines.slice(oldEnd + 1, oldEnd + 1 + suffixLen).map((line, k) => ({ type: 'same', line, oldNum: oldEnd + 2 + k, newNum: newEnd + 2 + k }))
 
   const subOld = oldLines.slice(start, oldEnd + 1)
   const subNew = newLines.slice(start, newEnd + 1)
   const subN = subOld.length, subM = subNew.length
   const middleItems = []
 
-  if (subN === 0) for (let j = 0; j < subM; j++) middleItems.push({ type: 'added', line: subNew[j], newNum: start + j + 1 })
-  else if (subM === 0) for (let i = 0; i < subN; i++) middleItems.push({ type: 'removed', line: subOld[i], oldNum: start + i + 1 })
+  if (subN === 0) middleItems.push(...subNew.map((line, j) => ({ type: 'added', line, newNum: start + j + 1 })))
+  else if (subM === 0) middleItems.push(...subOld.map((line, i) => ({ type: 'removed', line, oldNum: start + i + 1 })))
   else if (subN > 2000 || subM > 2000) {
-    for (let i = 0; i < subN; i++) middleItems.push({ type: 'removed', line: subOld[i], oldNum: start + i + 1 })
-    for (let j = 0; j < subM; j++) middleItems.push({ type: 'added', line: subNew[j], newNum: start + j + 1 })
+    middleItems.push(
+      ...subOld.map((line, i) => ({ type: 'removed', line, oldNum: start + i + 1 })),
+      ...subNew.map((line, j) => ({ type: 'added', line, newNum: start + j + 1 })),
+    )
   } else {
     const dp = Array.from({ length: subN + 1 }, () => new Uint16Array(subM + 1))
     for (let i = 0; i < subN; i++) {

package/lib/history.js

@@ -125,6 +125,7 @@ function normalizeRunRecord(record) {
     durationMs: Number(record.durationMs || 0),
     benchmarkReport: record.benchmarkReport || null,
     consensus: record.consensus || null,
+    error: record.error ? String(record.error) : null,
   }
 }
 

package/lib/moa-budget.js

@@ -29,6 +29,72 @@ export function estimateCandidateRunCost(slots = [], prices = {}, promptTokens =
   }
 }
 
+/**
+ * Estimates downstream synthesis costs for Round 2 and Judge panel.
+ */
+export function estimateDownstreamCost(aggregator, judgeModels = [], numCandidates = 1, prices = {}, expectedOutputTokens = 2048, promptTokens = 500, peerCritiqueEnabled = false) {
+  let downstream = 0
+  const aggInput = promptTokens + (expectedOutputTokens * numCandidates) + 200
+  const aggOutput = Math.min(expectedOutputTokens, 2048)
+
+  if (aggregator?.provider && aggregator?.model) {
+    const aggCost = estimateTokenCost(aggregator, { inputTokens: aggInput, outputTokens: aggOutput }, prices)
+    downstream += aggCost?.costUsd || 0
+  }
+  if (Array.isArray(judgeModels) && judgeModels.length > 0) {
+    for (const jm of judgeModels) {
+      if (jm?.provider && jm?.model) {
+        const jCost = estimateTokenCost(jm, { inputTokens: aggInput, outputTokens: aggOutput }, prices)
+        downstream += jCost?.costUsd || 0
+      }
+    }
+  }
+  return downstream
+}
+
+export function estimateRound2Cost(candidates = [], prices = {}, expectedOutputTokens = 2048, promptTokens = 500) {
+  let r2Total = 0
+  const numCandidates = candidates.length
+  if (numCandidates <= 1) return 0
+  // Each candidate reviews proposals from opponents (numCandidates - 1)
+  const r2Input = promptTokens + (expectedOutputTokens * (numCandidates - 1)) + 150
+  for (const c of candidates) {
+    const slot = c.slot || { provider: c.provider, model: c.model }
+    const cost = estimateTokenCost(slot, { inputTokens: r2Input, outputTokens: expectedOutputTokens }, prices)?.costUsd || 0
+    r2Total += cost
+  }
+  return r2Total
+}
+
+/**
+ * Phase-by-phase runtime budget check (#158).
+ * Checks if current spent + next phase estimate would exceed budget.
+ */
+export function checkPhaseBudget({
+  phaseName = '',
+  currentSpentUsd = 0,
+  nextPhaseCostUsd = 0,
+  maxBudgetUsd = 0,
+  action = 'abort',
+  enabled = true,
+}) {
+  if (!enabled || typeof maxBudgetUsd !== 'number' || maxBudgetUsd <= 0) {
+    return { allowed: true }
+  }
+  const projectedTotal = Number((currentSpentUsd + nextPhaseCostUsd).toFixed(6))
+  if (projectedTotal <= maxBudgetUsd) {
+    return { allowed: true, projectedTotal }
+  }
+  return {
+    allowed: false,
+    action,
+    currentSpentUsd,
+    projectedTotal,
+    maxBudgetUsd,
+    reason: `Projected cost ($${projectedTotal.toFixed(4)}) before ${phaseName} exceeds max budget ($${maxBudgetUsd.toFixed(4)}). Current spent: $${currentSpentUsd.toFixed(4)}.`,
+  }
+}
+
 /**
  * Applies budget guardrails before initiating parallel candidate execution.
  * Evaluates candidate runs, peer critique (Round 2) and downstream synthesis phases.
@@ -40,6 +106,7 @@ export function applyBudgetGuardrails({
   action = 'trim', // 'trim' | 'abort'
   prices = {},
   promptLength = 1000,
+  projectContext = '',
   messages = [],
   maxTokens = 2048,
   peerCritiqueEnabled = false,
@@ -55,8 +122,11 @@ export function applyBudgetGuardrails({
     }
   }
 
-  // Calculate full input tokens from userPrompt length + messages context
+  // Calculate full input tokens from userPrompt length + messages context + system prompt overhead
   let contextChars = Number(promptLength) || 1000
+  if (typeof projectContext === 'string' && projectContext.length > 0 && !String(promptLength).includes(String(projectContext.length))) {
+    contextChars += projectContext.length
+  }
   if (Array.isArray(messages) && messages.length > 0) {
     for (const m of messages) {
       if (typeof m?.content === 'string') {
@@ -68,36 +138,27 @@ export function applyBudgetGuardrails({
       }
     }
   }
-  const promptTokens = Math.max(50, Math.round(contextChars / 4))
+  // System prompt and framing template overhead (~600 chars = ~150 tokens)
+  const promptTokens = Math.max(50, Math.round((contextChars + 600) / 4))
   const expectedOutputTokens = typeof maxTokens === 'number' && maxTokens > 0 ? maxTokens : 2048
 
   // Base candidate cost per slot (Round 1)
   const { totalEstimatedUsd, slotEstimates } = estimateCandidateRunCost(references, prices, promptTokens, expectedOutputTokens)
 
-  // Estimate cost for downstream phases (Aggregator / Judge panel)
+  // Calculate downstream cost with specific candidate count
   function calcDownstreamUsd(numCandidates) {
-    let downstream = 0
-    if (aggregator?.provider && aggregator?.model) {
-      const aggInput = promptTokens + expectedOutputTokens * numCandidates
-      const aggCost = estimateTokenCost(aggregator, { inputTokens: aggInput, outputTokens: expectedOutputTokens }, prices)
-      downstream += aggCost?.costUsd || 0
-    }
-    if (Array.isArray(judgeModels) && judgeModels.length > 0) {
-      for (const jm of judgeModels) {
-        if (jm?.provider && jm?.model) {
-          const jInput = promptTokens + expectedOutputTokens * numCandidates
-          const jCost = estimateTokenCost(jm, { inputTokens: jInput, outputTokens: expectedOutputTokens }, prices)
-          downstream += jCost?.costUsd || 0
-        }
-      }
-    }
-    return downstream
+    return estimateDownstreamCost(aggregator, judgeModels, numCandidates, prices, expectedOutputTokens, promptTokens, peerCritiqueEnabled)
   }
 
-  // Multiplier if peer critique (Round 2) is enabled: each candidate runs another turn with input from all peers
-  const roundMultiplier = peerCritiqueEnabled ? 2 : 1
+  // Calculate Round 2 (Peer Critique) cost if enabled
+  function calcRound2Usd(candidates) {
+    if (!peerCritiqueEnabled || candidates.length <= 1) return 0
+    return estimateRound2Cost(candidates, prices, expectedOutputTokens, promptTokens)
+  }
+
+  const r2Usd = calcRound2Usd(references)
   const downstreamUsd = calcDownstreamUsd(references.length)
-  const fullEstimatedUsd = Number(((totalEstimatedUsd * roundMultiplier) + downstreamUsd).toFixed(6))
+  const fullEstimatedUsd = Number((totalEstimatedUsd + r2Usd + downstreamUsd).toFixed(6))
 
   if (fullEstimatedUsd <= maxBudgetUsd) {
     return {
@@ -120,22 +181,25 @@ export function applyBudgetGuardrails({
   }
 
   // Action is 'trim': Sort by estimated cost ascending (cheapest first)
-  // Factor downstream synthesis cost into candidate selection (#158)
+  // Factor downstream synthesis cost and peer critique cost into candidate selection (#158)
   const sorted = [...slotEstimates].sort((a, b) => a.costUsd - b.costUsd)
   const kept = []
-  let cumulativeCandidateCost = 0
 
   for (const item of sorted) {
-    const candidateCost = item.costUsd * roundMultiplier
-    const nextDownstream = calcDownstreamUsd(kept.length + 1)
-    if (cumulativeCandidateCost + candidateCost + nextDownstream <= maxBudgetUsd) {
+    const candidatePool = [...kept, item.slot]
+    const candR1 = candidatePool.reduce((acc, c) => {
+      const e = slotEstimates.find((s) => s.slot === c)
+      return acc + (e?.costUsd || 0)
+    }, 0)
+    const candR2 = calcRound2Usd(candidatePool)
+    const nextDownstream = calcDownstreamUsd(candidatePool.length)
+    if (candR1 + candR2 + nextDownstream <= maxBudgetUsd) {
       kept.push(item.slot)
-      cumulativeCandidateCost += candidateCost
     }
   }
 
   if (kept.length === 0) {
-    const minCandidateCost = (sorted[0]?.costUsd || 0) * roundMultiplier
+    const minCandidateCost = sorted[0]?.costUsd || 0
     const minTotal = minCandidateCost + calcDownstreamUsd(1)
     return {
       allowed: false,
@@ -149,7 +213,13 @@ export function applyBudgetGuardrails({
     }
   }
 
-  const finalEstimatedUsd = Number((cumulativeCandidateCost + calcDownstreamUsd(kept.length)).toFixed(6))
+  const finalR1 = kept.reduce((acc, c) => {
+    const e = slotEstimates.find((s) => s.slot === c)
+    return acc + (e?.costUsd || 0)
+  }, 0)
+  const finalR2 = calcRound2Usd(kept)
+  const finalEstimatedUsd = Number((finalR1 + finalR2 + calcDownstreamUsd(kept.length)).toFixed(6))
+
   return {
     allowed: true,
     references: kept,
@@ -161,3 +231,41 @@ export function applyBudgetGuardrails({
     reason: `Trimmed candidate pool from ${references.length} to ${kept.length} models to stay within budget ($${maxBudgetUsd.toFixed(4)}).`,
   }
 }
+
+/**
+ * Constructs a structured budget abort failure payload (#158).
+ */
+export function createBudgetAbortPayload({
+  reason,
+  primaryJudge,
+  referenceOutputs = [],
+  currentSpentUsd = 0,
+  preset = {},
+  isRefinement = false,
+  isFastMode = false,
+  collectedCtx = {},
+  startTime = Date.now(),
+}) {
+  const aggLabel = (primaryJudge?.provider && primaryJudge?.model) ? `${primaryJudge.provider}:${primaryJudge.model}` : "none";
+  return {
+    kind: "failure",
+    content: `🛑 Budget Guardrail Abort: ${reason}`,
+    aggregator: aggLabel,
+    references: referenceOutputs,
+    presetName: preset?.name || "default",
+    isRefinement,
+    isFastMode,
+    winningIndex: 0,
+    winnerModel: "none",
+    promotedFiles: [],
+    usage: {
+      totalTokens: referenceOutputs.reduce((acc, r) => acc + (r.usage?.totalTokens || 0), 0),
+      totalCostUsd: Number(currentSpentUsd.toFixed(5)),
+      candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
+      aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 },
+    },
+    skippedFiles: collectedCtx?.skippedFiles || 0,
+    skippedList: collectedCtx?.skippedList || [],
+    durationMs: Date.now() - startTime,
+  };
+}

package/lib/moa-candidates.js

@@ -122,7 +122,6 @@ export async function runReferencesParallel(references, messages, options = {},
             })
             reject(new Error(`Timeout after ${Math.round(timeoutMs / 1000)}s`))
           }, timeoutMs)
-          candidateTimer?.unref?.()
         })
 
         const res = await Promise.race([callPromise, timeoutPromise])

package/lib/moa-llm.js

@@ -139,3 +139,14 @@ export function createLlmCaller(ctx) {
     }
   }
 }
+
+
+export function callConfigEquals(a, b) {
+  if (!a || !b) return false
+  if (a.provider !== b.provider) return false
+  if (a.model !== b.model) return false
+  if (a.temperature !== b.temperature) return false
+  if (a.maxTokens !== b.maxTokens) return false
+  if (a.reasoningEffort !== b.reasoningEffort) return false
+  return true
+}

package/lib/moa-runner.js

@@ -9,7 +9,7 @@ import { parseWinnerIndex, parseRecommendedAssembler } from './moa-parser.js'
 import { REFERENCE_SYSTEM_PROMPT, callWithTransientRetry, runReferencesParallel } from './moa-candidates.js'
 import { executeTestGateForCandidates } from './moa-test-gate.js'
 import { executeMultiJudgePanel, buildCompositeBlockDirectives } from './moa-multi-judge.js'
-import { applyBudgetGuardrails } from './moa-budget.js'
+import { applyBudgetGuardrails, checkPhaseBudget, estimateRound2Cost, estimateDownstreamCost, createBudgetAbortPayload } from './moa-budget.js'
 import { extractPriorTurnBaseline, pruneMultiTurnMessages } from './moa-context.js'
 import { generateMoABenchmarkReport } from './moa-report.js'
 // Re-exports for consumers & backward compatibility
@@ -60,14 +60,33 @@ export async function runMoAPipeline({
   const aggTimeoutSec = typeof preset?.aggregator_timeout_sec === 'number' ? preset.aggregator_timeout_sec : 180
   const isBlindEvaluation = Boolean(preset?.blind_evaluation), isPeerCritiqueEnabled = Boolean(preset?.peer_critique_enabled)
   const allowCandidateOverride = Boolean(preset?.allow_candidate_override)
-  // Feature 6: Budget Guardrail check
+  // 1. Collect project context for refinement tasks
+  const collectedCtx = await collectProjectContext(cwd, 16000)
+  const isRefinement = Boolean(collectedCtx?.files?.length > 0 && isRefinementTask(userPrompt, collectedCtx.files))
+  let projectContext = ''
+  if (collectedCtx?.skippedFiles > 0 && typeof onProgress === 'function') {
+    const preview = collectedCtx.skippedList.slice(0, 3).join(', ')
+    const more = collectedCtx.skippedList.length > 3 ? ` (+${collectedCtx.skippedList.length - 3})` : ''
+    onProgress(`⚠️ *Workspace scan note: ${collectedCtx.skippedFiles} file(s) skipped (${preview}${more})*\n`)
+  }
+  if (isRefinement) {
+    if (typeof onProgress === 'function') {
+      onProgress('🔍 *Reading project files for refinement context...*\n')
+    }
+    projectContext = formatProjectContext(collectedCtx.files, {
+      skippedFiles: collectedCtx.skippedFiles,
+      skippedList: collectedCtx.skippedList,
+    })
+  }
+  // 2. Budget Guardrail check
   const budgetCheck = applyBudgetGuardrails({
     references: referenceModels,
     enabled: preset?.budget_guard_enabled,
     maxBudgetUsd: preset?.max_budget_usd,
     action: preset?.budget_action || 'trim',
     prices,
-    promptLength: userPrompt?.length || 1000,
+    promptLength: (userPrompt?.length || 1000) + (projectContext ? projectContext.length : 0),
+    projectContext,
     messages,
     maxTokens,
     peerCritiqueEnabled: isPeerCritiqueEnabled,
@@ -75,45 +94,12 @@ export async function runMoAPipeline({
     judgeModels: preset?.multi_judge_enabled ? preset?.judge_models : [],
   })
   if (!budgetCheck.allowed) {
-    return {
-      kind: 'failure',
-      content: `🛑 Budget Guardrail Abort: ${budgetCheck.reason}`,
-      aggregator: slotLabel(primaryJudge),
-      references: [],
-      presetName: preset?.name || 'default',
-      isRefinement: false,
-      isFastMode,
-      winningIndex: 0,
-      winnerModel: 'none',
-      promotedFiles: [],
-      usage: { totalTokens: 0, totalCostUsd: 0, candidates: [], aggregator: { totalTokens: 0, costUsd: 0 } },
-      skippedFiles: 0,
-      skippedList: [],
-      durationMs: Date.now() - startTime,
-    }
+    return createBudgetAbortPayload({ reason: budgetCheck.reason, primaryJudge, referenceOutputs: [], currentSpentUsd: 0, preset, isRefinement, isFastMode, collectedCtx, startTime })
   }
   const effectiveReferences = budgetCheck.references
   if (budgetCheck.action === 'trim' && typeof onProgress === 'function') {
     onProgress(`✂️ *${budgetCheck.reason}*\n`)
   }
-  // 2. Collect project context for refinement tasks
-  const collectedCtx = await collectProjectContext(cwd, 16000)
-  const isRefinement = Boolean(collectedCtx?.files?.length > 0 && isRefinementTask(userPrompt, collectedCtx.files))
-  let projectContext = ''
-  if (collectedCtx?.skippedFiles > 0 && typeof onProgress === 'function') {
-    const preview = collectedCtx.skippedList.slice(0, 3).join(', ')
-    const more = collectedCtx.skippedList.length > 3 ? ` (+${collectedCtx.skippedList.length - 3})` : ''
-    onProgress(`⚠️ *Workspace scan note: ${collectedCtx.skippedFiles} file(s) skipped (${preview}${more})*\n`)
-  }
-  if (isRefinement) {
-    if (typeof onProgress === 'function') {
-      onProgress('🔍 *Reading project files for refinement context...*\n')
-    }
-    projectContext = formatProjectContext(collectedCtx.files, {
-      skippedFiles: collectedCtx.skippedFiles,
-      skippedList: collectedCtx.skippedList,
-    })
-  }
   // 3. Build prompts & Feature 8 multi-turn context
   const priorTurnBaseline = preset?.multi_turn_enabled !== false ? extractPriorTurnBaseline(messages) : null
   const prunedHistory = preset?.multi_turn_enabled !== false ? pruneMultiTurnMessages(messages) : messages
@@ -152,26 +138,14 @@ export async function runMoAPipeline({
   const successfulRefs = referenceOutputs.filter((r) => r.ok)
   if (successfulRefs.length === 0) {
     const reasons = referenceOutputs.map((r) => `${r.label}: ${r.error || 'unknown error'}`).join('; ')
+    const totalTokens = referenceOutputs.reduce((acc, r) => acc + (r.usage?.totalTokens || 0), 0)
+    const totalCostUsd = Number((referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0)).toFixed(5))
     return {
-      kind: 'failure',
-      content: `⚠️ All advisor models (${referenceOutputs.length}) failed: ${reasons}`,
-      aggregator: slotLabel(primaryJudge),
-      references: referenceOutputs,
-      presetName: preset?.name || 'default',
-      isRefinement,
-      isFastMode,
-      winningIndex: 0,
-      winnerModel: 'none',
-      promotedFiles: [],
-      usage: {
-        totalTokens: 0,
-        totalCostUsd: 0,
-        candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
-        aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 },
-      },
-      skippedFiles: collectedCtx?.skippedFiles || 0,
-      skippedList: collectedCtx?.skippedList || [],
-      durationMs: Date.now() - startTime,
+      kind: 'failure', content: `⚠️ All advisor models (${referenceOutputs.length}) failed: ${reasons}`,
+      aggregator: slotLabel(primaryJudge), references: referenceOutputs, presetName: preset?.name || 'default',
+      isRefinement, isFastMode, winningIndex: 0, winnerModel: 'none', promotedFiles: [],
+      usage: { totalTokens, totalCostUsd, candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })), aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 } },
+      skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [], durationMs: Date.now() - startTime,
     }
   }
   // 5. Extract file blocks & write candidate workspaces
@@ -247,25 +221,11 @@ export async function runMoAPipeline({
       logger.warn('[dsh-moa] Failed to record questionnaire run in history:', histErr?.message || histErr)
     }
     return {
-      kind: 'questions',
-      content: questionsContent,
-      aggregator: slotLabel(primaryJudge),
-      references: referenceOutputs,
-      presetName: preset?.name || 'default',
-      isRefinement,
-      isFastMode,
-      winningIndex: 0,
-      winnerModel: 'none',
-      promotedFiles: [],
-      usage: {
-        totalTokens,
-        totalCostUsd,
-        candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
-        aggregator: qUsage,
-      },
-      skippedFiles: collectedCtx?.skippedFiles || 0,
-      skippedList: collectedCtx?.skippedList || [],
-      durationMs,
+      kind: 'questions', content: questionsContent, aggregator: slotLabel(primaryJudge),
+      references: referenceOutputs, presetName: preset?.name || 'default', isRefinement, isFastMode,
+      winningIndex: 0, winnerModel: 'none', promotedFiles: [],
+      usage: { totalTokens, totalCostUsd, candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })), aggregator: qUsage },
+      skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [], durationMs,
     }
   }
 
@@ -284,9 +244,40 @@ export async function runMoAPipeline({
     } else if (!allowCandidateOverride) {
       await cleanMoaWorkspaces(cwd, { runId })
     }
-    if (signal?.aborted || promoteErr?.message?.includes('aborted') || promoteErr?.name === 'AbortError') {
+    if (promoteErr) {
       if (!allowCandidateOverride) await cleanMoaWorkspaces(cwd, { runId })
-      return { error: new Error('Turn aborted') }
+      if (signal?.aborted || promoteErr?.message?.includes('aborted') || promoteErr?.name === 'AbortError' || promoteErr?.message === 'Turn aborted') {
+        return { error: new Error('Turn aborted') }
+      }
+      const totalTokens = referenceOutputs.reduce((acc, r) => acc + (r.usage?.totalTokens || 0), 0)
+      const totalCostUsd = Number((referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0)).toFixed(5))
+      const durationMs = Date.now() - startTime
+      try {
+        await recordMoaRunAsync({
+          id: runId, cwd, prompt: userPrompt, preset: preset?.name || 'default',
+          isRefinement, isFastMode: true, candidates: candidatesForHistory(referenceOutputs),
+          aggregator: null, winnerIndex: 0, winnerModel: 'none',
+          promotedFiles: [], totalTokens, totalCostUsd, durationMs,
+          error: promoteErr?.message || String(promoteErr),
+        }, historyFilePath || undefined)
+      } catch (histErr) {
+        logger.warn('[dsh-moa] Failed to record fast synthesis failure in history:', histErr?.message || histErr)
+      }
+      return {
+        kind: 'failure', error: promoteErr,
+        content: '🛑 Checkpoint or Promotion Failure: ' + (promoteErr?.message || String(promoteErr)),
+        aggregator: 'Fast Mode (Direct)', references: referenceOutputs,
+        presetName: preset?.name || 'default', isRefinement, isFastMode: true,
+        winningIndex: 0, winnerModel: 'none', promotedFiles: [], runId,
+        usage: {
+          totalTokens, totalCostUsd,
+          candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
+          aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 },
+        },
+        skippedFiles: collectedCtx?.skippedFiles || 0,
+        skippedList: collectedCtx?.skippedList || [],
+        durationMs,
+      }
     }
 
     const livePreview = await createPromotedPreview(liveCanvas, cwd, promotedFiles, referenceOutputs, { winningIndex: single.index })
@@ -306,18 +297,11 @@ export async function runMoAPipeline({
     }
 
     return {
-      kind: 'synthesis', content: single.text, aggregator: 'Fast Mode (Direct)',
-      references: referenceOutputs, presetName: preset?.name || 'default',
-      isRefinement, isFastMode: true, winningIndex: single.index,
-      winnerModel: single.label, promotedFiles, runId,
-      ...(livePreview ? { liveCanvas: livePreview } : {}),
-      usage: {
-        totalTokens, totalCostUsd,
-        candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
-        aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 },
-      },
-      skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [],
-      durationMs,
+      kind: 'synthesis', content: single.text, aggregator: 'Fast Mode (Direct)', references: referenceOutputs,
+      presetName: preset?.name || 'default', isRefinement, isFastMode: true, winningIndex: single.index,
+      winnerModel: single.label, promotedFiles, runId, ...(livePreview ? { liveCanvas: livePreview } : {}),
+      usage: { totalTokens, totalCostUsd, candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })), aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 } },
+      skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [], durationMs,
     }
   }
 
@@ -327,7 +311,29 @@ export async function runMoAPipeline({
   }
 
   // 7b. Consilium Round 2 (Peer Critique) if enabled
-  if (isPeerCritiqueEnabled && successfulRefs.length > 1) {
+  let runRound2 = isPeerCritiqueEnabled && successfulRefs.length > 1
+  if (runRound2 && preset?.budget_guard_enabled && preset?.max_budget_usd > 0) {
+    const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0)
+    const r2Next = estimateRound2Cost(successfulRefs, prices, maxTokens)
+    const downNext = estimateDownstreamCost(primaryJudge, preset?.judge_models, successfulRefs.length, prices, maxTokens)
+    const phaseCheck = checkPhaseBudget({
+      phaseName: 'Consilium Round 2', currentSpentUsd: currentSpent,
+      nextPhaseCostUsd: r2Next + downNext, maxBudgetUsd: preset.max_budget_usd,
+      action: preset.budget_action || 'trim', enabled: true,
+    })
+    if (!phaseCheck.allowed) {
+      if (phaseCheck.action === 'abort') {
+        await cleanMoaWorkspaces(cwd, { runId })
+        return createBudgetAbortPayload({ reason: phaseCheck.reason, primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime })
+      }
+      runRound2 = false
+      if (typeof onProgress === 'function') {
+        onProgress(`✂️ *Skipping Round 2 to stay within budget ($${preset.max_budget_usd.toFixed(4)})*\n`)
+      }
+    }
+  }
+
+  if (runRound2) {
     if (typeof onProgress === 'function') {
       onProgress('🤝 *Consilium Round 2: Candidates reviewing peer proposals in parallel...*\n')
     }
@@ -366,8 +372,8 @@ export async function runMoAPipeline({
           const extraCost = estimateTokenCost(slot, res.usage, prices)
           cand.costUsd = Number(((cand.costUsd || 0) + extraCost.costUsd).toFixed(5))
         }
-      } catch (r2CostErr) {
-        logger.warn('[dsh-moa] Failed to estimate Round 2 cost:', r2CostErr?.message || r2CostErr)
+      } catch (r2Err) {
+        logger.warn(`[dsh-moa] Round 2 peer critique failed for candidate ${cand.index}:`, r2Err?.message || r2Err)
       }
     })
     await Promise.allSettled(r2Promises)
@@ -407,6 +413,19 @@ export async function runMoAPipeline({
     : null
 
   // 8. Synthesis phase via primary judge or fallback chain
+  if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0 && !isFastMode) {
+    const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + (multiJudgeResult?.totalCostUsd || 0)
+    const downNext = estimateDownstreamCost(primaryJudge, [], successfulRefs.length, prices, maxTokens)
+    const phaseCheck = checkPhaseBudget({
+      phaseName: 'Judge Synthesis', currentSpentUsd: currentSpent,
+      nextPhaseCostUsd: downNext, maxBudgetUsd: preset.max_budget_usd,
+      action: preset.budget_action || 'trim', enabled: true,
+    })
+    if (!phaseCheck.allowed) {
+      await cleanMoaWorkspaces(cwd, { runId })
+      return createBudgetAbortPayload({ reason: phaseCheck.reason, primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime })
+    }
+  }
   const synthesisPrompt = buildSynthesisPrompt(userPrompt, referenceOutputs, judgeCriteria, {
     curatorSynthesis: isCuratorSynthesis,
     blindEvaluation: isBlindEvaluation,
@@ -543,46 +562,21 @@ export async function runMoAPipeline({
 
   try {
     await recordMoaRunAsync({
-      id: runId,
-      cwd,
-      prompt: userPrompt,
-      preset: preset?.name || 'default',
-      isRefinement,
+      id: runId, cwd, prompt: userPrompt, preset: preset?.name || 'default', isRefinement,
       candidates: candidatesForHistory(referenceOutputs),
       aggregator: { provider: chosenJudge.provider, model: chosenJudge.model, usage: aggUsage, costUsd: aggUsage.costUsd },
-      winnerIndex: winningIndex,
-      winnerModel,
-      promotedFiles,
-      benchmarkReport,
-      consensus: multiJudgeResult,
-      totalTokens: usageSummary.totalTokens,
-      totalCostUsd: usageSummary.totalCostUsd,
-      durationMs,
+      winnerIndex: winningIndex, winnerModel, promotedFiles, benchmarkReport, consensus: multiJudgeResult,
+      totalTokens: usageSummary.totalTokens, totalCostUsd: usageSummary.totalCostUsd, durationMs,
     }, historyFilePath || undefined)
   } catch (histErr) {
     logger.warn('[dsh-moa] Failed to record run in history:', histErr)
   }
 
   return {
-    kind: 'synthesis',
-    content: synthesizedText,
-    aggregator: isFastMode ? 'Fast Mode (Direct)' : finalAggLabel,
-    references: referenceOutputs,
-    presetName: preset?.name || 'default',
-    isRefinement,
-    isFastMode,
-    isCuratorSynthesis,
-    recommendedAssembler,
-    winningIndex,
-    winnerModel,
-    promotedFiles,
-    runId,
-    allowCandidateOverride,
-    benchmarkReport,
-    consensus: multiJudgeResult,
-    ...(livePreview ? { liveCanvas: livePreview } : {}),
-    usage: usageSummary,
-    skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [],
-    durationMs,
+    kind: 'synthesis', content: synthesizedText, aggregator: isFastMode ? 'Fast Mode (Direct)' : finalAggLabel,
+    references: referenceOutputs, presetName: preset?.name || 'default', isRefinement, isFastMode, isCuratorSynthesis,
+    recommendedAssembler, winningIndex, winnerModel, promotedFiles, runId, allowCandidateOverride,
+    benchmarkReport, consensus: multiJudgeResult, ...(livePreview ? { liveCanvas: livePreview } : {}),
+    usage: usageSummary, skippedFiles: collectedCtx?.skippedFiles || 0, skippedList: collectedCtx?.skippedList || [], durationMs,
   }
 }

package/lib/moa-test-gate.js

@@ -5,6 +5,7 @@ import path from 'node:path'
 import { spawn } from 'node:child_process'
 import { resolveCandidateFolder } from './file-workspace.js'
 import { bestEffort } from './best-effort.js'
+import { logger } from './logger.js'
 
 const MAX_CAPTURE_BYTES = 256 * 1024
 
@@ -42,6 +43,29 @@ export function resolveCandidateDir(baseDir, candidateIndex, options = {}) {
   }
 }
 
+/**
+ * Validates that an executed script or command does not reference files outside allowed roots (#161).
+ */
+function scanPathTokensForLeak(text, allowedRoots, executionDir) {
+  if (!text || typeof text !== 'string') return null
+  const sanitized = text
+    .replace(/https?:\/\/[^\s"'<>]+/gi, '')
+    .replace(/\b(?:node|file|npm|data):[^\s"'<>]+/gi, '')
+  const matches = sanitized.match(/(?:[a-zA-Z]:[\\/][^\s"'<>]+|(?<![\w.@\/\\])\/(?:[a-zA-Z0-9_\-.]+\/)*[a-zA-Z0-9_\-.]+|(?<![\w.@\/\\])\.\.[\\/][^\s"'<>]*)/g) || []
+  for (const raw of matches) {
+    if (/^\/(usr\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\/|$)/.test(raw) && !/\.(txt|json|env|npmrc|key|ssh|md)/i.test(raw)) {
+      continue
+    }
+    if (!path.isAbsolute(raw) && !raw.startsWith('..')) continue
+    const resolved = path.resolve(executionDir, raw)
+    const allowed = allowedRoots.some((r) => r && (resolved === r || resolved.startsWith(r + path.sep)))
+    if (!allowed) {
+      return raw
+    }
+  }
+  return null
+}
+
 /**
  * Executes a test command in a candidate sandbox or ephemeral test staging directory.
  */
@@ -63,6 +87,7 @@ export async function runCandidateTestGate({
 
   const startTime = Date.now()
   let stageDir = null
+  let fenceFile = null
   let executionDir = candidateDir
 
   try {
@@ -70,7 +95,6 @@ export async function runCandidateTestGate({
     const candPkg = path.join(candidateDir, 'package.json')
     if (fsSync.existsSync(basePkg) && !fsSync.existsSync(candPkg)) {
       stageDir = await fs.mkdtemp(path.join(os.tmpdir(), `moa-test-stage-${candidateIndex}-`))
-
       await fs.cp(cwd, stageDir, {
         recursive: true,
         filter: (src) => {
@@ -80,8 +104,6 @@ export async function runCandidateTestGate({
           return parts[0] !== 'node_modules' && parts[0] !== '.git' && parts[0] !== '.moa'
         },
       })
-
-      // #162: Preserve ESM & CJS resolution by symlinking project node_modules
       const baseNodeModules = path.join(cwd, 'node_modules')
       const stageNodeModules = path.join(stageDir, 'node_modules')
       if (fsSync.existsSync(baseNodeModules)) {
@@ -89,15 +111,24 @@ export async function runCandidateTestGate({
           fs.symlink(baseNodeModules, stageNodeModules, process.platform === 'win32' ? 'junction' : 'dir')
         )
       }
-
       await fs.cp(candidateDir, stageDir, { recursive: true })
       executionDir = stageDir
     }
 
-    const resolvedCmd = trimmedCmd
-      .replaceAll('{candidateDir}', candidateDir)
-      .replaceAll('{baseDir}', cwd)
-      .replaceAll('{stageDir}', executionDir)
+    const replacePlaceholderSafely = (cmd, placeholder, dirPath) => {
+      if (!cmd.includes(placeholder)) return cmd
+      let res = cmd.replace(new RegExp(`(["'])(.*?)${placeholder}(.*?)\\1`, 'g'), (m, q, pre, post) => `${q}${pre}${dirPath}${post}${q}`)
+      res = res.replace(new RegExp(`(?<=^|\\s)([^\\s"']*?)${placeholder}([^\\s"']*?)(?=\\s|$)`, 'g'), (m, pre, post) => {
+        const full = pre + dirPath + post
+        return full.includes(' ') ? `"${full}"` : full
+      })
+      return res
+    }
+
+    let resolvedCmd = trimmedCmd
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{candidateDir}', candidateDir)
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{baseDir}', cwd)
+    resolvedCmd = replacePlaceholderSafely(resolvedCmd, '{stageDir}', executionDir)
 
     let exitCode = 0
     let stdout = ''
@@ -114,18 +145,165 @@ export async function runCandidateTestGate({
       stdout = customRes?.stdout || ''
       stderr = customRes?.stderr || ''
     } else {
-      const nodePath = path.join(cwd, 'node_modules')
+      const allowedRoots = [executionDir, cwd, ...(candidateDir && candidateDir !== executionDir ? [candidateDir] : [])]
+      const cmdTokens = resolvedCmd.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []
+
+      // 1. Check command tokens for absolute path leaks
+      for (const rawToken of cmdTokens) {
+        const token = rawToken.replace(/^["']|["']$/g, '')
+        if (path.isAbsolute(token) || token.startsWith('..')) {
+          if (/^\/(usr\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\/|$)/.test(token) && !/\.(txt|json|env|npmrc|key|ssh|md)/i.test(token)) {
+            continue
+          }
+          const resolved = path.resolve(executionDir, token)
+          const allowed = allowedRoots.some((r) => r && (resolved === r || resolved.startsWith(r + path.sep)))
+          if (!allowed) {
+            const durationMs = Date.now() - startTime
+            return {
+              candidateIndex,
+              passed: false,
+              exitCode: 1,
+              durationMs,
+              command: resolvedCmd,
+              output: `Access denied: test command specifies path outside workspace sandbox (${token})`,
+              summary: `FAIL (code 1, ${durationMs}ms)`,
+            }
+          }
+        }
+      }
+
+      // 2. Scan script files referenced by command or present in candidate workspace (#161)
+      const candFiles = fsSync.existsSync(executionDir) ? fsSync.readdirSync(executionDir) : []
+      const scriptTokens = new Set([
+        ...cmdTokens.map((t) => t.replace(/^["']|["']$/g, '')),
+        ...candFiles,
+      ])
+
+      for (const scriptName of scriptTokens) {
+        const scriptPath = path.isAbsolute(scriptName) ? scriptName : path.join(executionDir, scriptName)
+        if (fsSync.existsSync(scriptPath) && !fsSync.statSync(scriptPath).isDirectory()) {
+          try {
+            const scriptText = fsSync.readFileSync(scriptPath, 'utf8')
+            const leaked = scanPathTokensForLeak(scriptText, allowedRoots, executionDir)
+            if (leaked) {
+              const durationMs = Date.now() - startTime
+              return {
+                candidateIndex,
+                passed: false,
+                exitCode: 1,
+                durationMs,
+                command: resolvedCmd,
+                output: `Access denied: test script specifies path outside workspace sandbox (${leaked})`,
+                summary: `FAIL (code 1, ${durationMs}ms)`,
+              }
+            }
+          } catch {}
+        }
+      }
+
+      // 3. Scan package.json scripts if package.json exists in executionDir (#161, #206)
+      const candPkgFile = path.join(executionDir, 'package.json')
+      if (fsSync.existsSync(candPkgFile)) {
+        try {
+          const pkgObj = JSON.parse(fsSync.readFileSync(candPkgFile, 'utf8'))
+          const scriptsContent = Object.values(pkgObj.scripts || {}).join('\n')
+          const leaked = scanPathTokensForLeak(scriptsContent, allowedRoots, executionDir)
+          if (leaked) {
+            const durationMs = Date.now() - startTime
+            return {
+              candidateIndex,
+              passed: false,
+              exitCode: 1,
+              durationMs,
+              command: resolvedCmd,
+              output: `Access denied: package.json test script specifies path outside workspace sandbox (${leaked})`,
+              summary: `FAIL (code 1, ${durationMs}ms)`,
+            }
+          }
+        } catch {}
+      }
+
+      // Setup isolated HOME & node roots
+      const rawHome = process.env.HOME
+      const isCustomHome = rawHome && (rawHome.startsWith(cwd) || rawHome.startsWith(executionDir) || rawHome.includes('fake-home') || rawHome.startsWith(os.tmpdir()))
+      let effectiveHome = isCustomHome ? rawHome : path.join(executionDir, '.moa-home')
+      if (!fsSync.existsSync(effectiveHome)) {
+        await bestEffort('create candidate test home', () => fs.mkdir(effectiveHome, { recursive: true }))
+      }
+
+      const nodeRoot = path.resolve(path.dirname(process.execPath), '..')
+      const nodeBinDir = path.dirname(process.execPath)
       const allowedReads = [
         executionDir,
         cwd,
+        effectiveHome,
         ...(candidateDir && candidateDir !== executionDir ? [candidateDir] : []),
+        nodeRoot,
+        nodeBinDir,
         ...(process.platform === 'win32'
-          ? [process.env.SYSTEMROOT || 'C:\\Windows', path.dirname(process.execPath)]
-          : ['/usr', '/lib', '/lib64', '/etc', path.resolve(path.dirname(process.execPath), '..'), process.env.HOME ? path.join(process.env.HOME, '.npmrc') : null]),
+          ? [process.env.SYSTEMROOT || 'C:\\Windows']
+          : ['/usr', '/lib', '/lib64', '/etc']),
       ].filter(Boolean)
-      const permOpts = `--permission ${allowedReads.map((p) => `--allow-fs-read=${p}`).join(' ')} --allow-fs-write=${executionDir} --allow-child-process`
 
+      // Create security fence module for child process containment (#161, #206)
+      fenceFile = path.join(executionDir, `.moa-fence-${Date.now()}.cjs`)
+      const fenceCode = `
+const cp = require('node:child_process');
+const path = require('node:path');
+const allowed = ${JSON.stringify(allowedReads)};
+function checkPath(p) {
+  if (!p || typeof p !== 'string') return true;
+  if (/^\\/(usr\\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\\/|$)/.test(p) && !/\\.(txt|json|env|npmrc|key|ssh|md)/i.test(p)) return true;
+  const res = path.resolve(process.cwd(), p);
+  return allowed.some(root => root && (res === root || res.startsWith(root + path.sep)));
+}
+function guardArgs(cmd, args) {
+  if (cmd && typeof cmd === 'string' && !checkPath(cmd)) {
+    throw new Error('ERR_ACCESS_DENIED: child process binary outside sandbox: ' + cmd);
+  }
+  if (Array.isArray(args)) {
+    for (const a of args) {
+      if (!checkPath(a)) throw new Error('ERR_ACCESS_DENIED: child process argument outside sandbox: ' + a);
+    }
+  }
+}
+const origSpawn = cp.spawn;
+cp.spawn = function(cmd, args, opts) {
+  guardArgs(cmd, args);
+  return origSpawn.apply(this, arguments);
+};
+const origSpawnSync = cp.spawnSync;
+cp.spawnSync = function(cmd, args, opts) {
+  guardArgs(cmd, args);
+  return origSpawnSync.apply(this, arguments);
+};
+const origExecFile = cp.execFile;
+cp.execFile = function(file, args, opts, cb) {
+  guardArgs(file, args);
+  return origExecFile.apply(this, arguments);
+};
+const origExecFileSync = cp.execFileSync;
+cp.execFileSync = function(file, args, opts) {
+  guardArgs(file, args);
+  return origExecFileSync.apply(this, arguments);
+};
+const origExec = cp.exec;
+cp.exec = function(cmd, opts, cb) {
+  guardArgs(cmd, [cmd]);
+  return origExec.apply(this, arguments);
+};
+const origExecSync = cp.execSync;
+cp.execSync = function(cmd, opts) {
+  guardArgs(cmd, [cmd]);
+  return origExecSync.apply(this, arguments);
+};
+`
+      fsSync.writeFileSync(fenceFile, fenceCode, 'utf8')
+
+      const permOpts = `--permission ${allowedReads.map((p) => `--allow-fs-read=${p}`).join(' ')} --allow-fs-write=${executionDir} --allow-fs-write=${effectiveHome} --allow-child-process --require ${fenceFile}`
+      const nodePath = path.join(cwd, 'node_modules')
       const env = getScrubbedEnv({
+        HOME: effectiveHome,
         MOA_CANDIDATE_INDEX: String(candidateIndex),
         MOA_CANDIDATE_DIR: candidateDir,
         MOA_BASE_DIR: cwd,
@@ -243,6 +421,9 @@ export async function runCandidateTestGate({
       summary: `ERROR (${err.message || 'unknown'})`,
     }
   } finally {
+    if (fenceFile) {
+      await bestEffort('moa-test-gate cleanup fenceFile', () => fs.rm(fenceFile, { force: true }))
+    }
     if (stageDir) {
       await bestEffort('moa-test-gate cleanup stageDir', () =>
         fs.rm(stageDir, { recursive: true, force: true })

package/lib/routes.js

@@ -2,13 +2,9 @@
  * DeepSeek Harness Mixture of Agents (MoA) — HTTP Route Handlers
  */
 
-import {
-  getMoaHistory,
-  getMoaLeaderboard,
-  getMoaRunById,
-  exportMoaHistory,
-} from './history.js'
-import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff, isSafeRelativePath } from './file-workspace.js'
+import path from 'node:path'
+import { getMoaHistory, getMoaLeaderboard, getMoaRunById, exportMoaHistory } from './history.js'
+import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff, isSafeRelativePath, isLoopbackUrl } from './file-workspace.js'
 import { isSafeWriteRequest } from './updater.js'
 import { runMoAPipeline } from './moa-runner.js'
 import { generateMoABenchmarkReport } from './moa-report.js'
@@ -18,10 +14,7 @@ let _modelsCache = { timestamp: 0, models: [] }
 const MODELS_CACHE_TTL = 60 * 1000
 
 function writeJson(res, status, body) {
-  res.writeHead(status, {
-    'Content-Type': 'application/json; charset=utf-8',
-    'Cache-Control': 'no-store',
-  })
+  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' })
   res.end(JSON.stringify(body))
 }
 
@@ -30,10 +23,7 @@ function readBody(req) {
     let acc = ''
     req.on('data', (chunk) => {
       acc += chunk
-      if (acc.length > 5 * 1024 * 1024) {
-        req.destroy()
-        reject(new Error('Payload Too Large'))
-      }
+      if (acc.length > 5 * 1024 * 1024) { req.destroy(); reject(new Error('Payload Too Large')) }
     })
     req.on('end', () => resolve(acc))
     req.on('error', reject)
@@ -134,19 +124,11 @@ ctx.effect(() => {
         // Query settings for configured providers
         try {
           let s = null
-          try {
-            s = ctx.get ? ctx.get('settings') : null
-          } catch {
-            s = null
-          }
-          const getSetting = (k) => {
-            try { return s?.get?.(k) } catch { return undefined }
-          }
+          try { s = ctx.get ? ctx.get('settings') : null } catch { s = null }
+          const getSetting = (k) => { try { return s?.get?.(k) } catch { return undefined } }
 
           const def = getSetting('agent-default-model')
-          if (def?.provider && def?.model) {
-            add(def.provider, def.model)
-          }
+          if (def?.provider && def?.model) add(def.provider, def.model)
 
           const piAi = getSetting('llm-pi-ai')
           for (const [pName, pData] of Object.entries(piAi?.providers || {})) {
@@ -220,12 +202,8 @@ ctx.effect(() => {
 
             // Persist via saveConfig (in-memory and DSH profile settings)
             if (typeof saveConfig === 'function') {
-              try {
-                await saveConfig(validated)
-              } catch (perr) {
-                writeJson(res, 500, { ok: false, error: 'Settings persistence failed: ' + (perr?.message || String(perr)) })
-                return
-              }
+              try { await saveConfig(validated) }
+              catch (perr) { return writeJson(res, 500, { ok: false, error: 'Settings persistence failed: ' + (perr?.message || String(perr)) }) }
             }
 
             const unwrapped = typeof plainConfig === 'function' ? plainConfig(validated) : validated
@@ -258,10 +236,8 @@ ctx.effect(() => {
         }
         try {
           const u = new URL(req.url, 'http://localhost')
-          const rawLimit = parseInt(u.searchParams.get('limit') || '20', 10)
-          const rawOffset = parseInt(u.searchParams.get('offset') || '0', 10)
-          const limit = Math.max(1, Math.min(100, Number.isFinite(rawLimit) ? rawLimit : 20))
-          const offset = Math.max(0, Number.isFinite(rawOffset) ? rawOffset : 0)
+          const limit = Math.max(1, Math.min(100, parseInt(u.searchParams.get('limit') || '20', 10) || 20))
+          const offset = Math.max(0, parseInt(u.searchParams.get('offset') || '0', 10) || 0)
           const data = getMoaHistory(limit, offset)
           writeJson(res, 200, { ok: true, ...data })
         } catch (err) {
@@ -329,6 +305,13 @@ ctx.effect(() => {
           }
           const cwd = body?.cwd || process.cwd()
           const runId = body?.runId
+          if (runId) {
+            const recordedRun = getMoaRunById(runId)
+            if (recordedRun && body?.cwd && path.resolve(body.cwd) !== path.resolve(recordedRun.cwd)) {
+              writeJson(res, 403, { ok: false, error: 'Forbidden: cwd does not match recorded run cwd' })
+              return
+            }
+          }
           const promotedFiles = await promoteCandidateWorkspace(cwd, candidateIndex, {
             runId,
             keepMoa: true,
@@ -357,10 +340,23 @@ ctx.effect(() => {
         try {
           const u = new URL(req.url, 'http://localhost')
           const rawRunId = u.searchParams.get('runId')
-          const latestRun = (!rawRunId || rawRunId === 'latest' || rawRunId === 'active') ? getMoaHistory(1, 0).runs[0] : null
-          const runId = (rawRunId && rawRunId !== 'latest' && rawRunId !== 'active') ? rawRunId : latestRun?.id
-          const run = runId ? getMoaRunById(runId) : null
-          const cwd = run?.cwd || latestRun?.cwd || u.searchParams.get('cwd') || process.cwd()
+          const queryCwd = u.searchParams.get('cwd')
+          let run = null
+          if (rawRunId && rawRunId !== 'latest' && rawRunId !== 'active') {
+            run = getMoaRunById(rawRunId)
+            if (!run) {
+              writeJson(res, 404, { ok: false, error: `Run '${rawRunId}' not found` })
+              return
+            }
+          } else {
+            run = getMoaHistory(1, 0).runs[0] || null
+          }
+          if (run && queryCwd && path.resolve(queryCwd) !== path.resolve(run.cwd)) {
+            writeJson(res, 403, { ok: false, error: 'Forbidden: cwd does not match recorded run cwd' })
+            return
+          }
+          const runId = run?.id
+          const cwd = run?.cwd || queryCwd || process.cwd()
           const sanitizeTarget = (val, def) => {
             const clean = String(val || '').trim().replace(/[^a-zA-Z0-9_-]/g, '')
             return clean || def
@@ -421,18 +417,10 @@ ctx.effect(() => {
           const format = url.searchParams.get('format') || 'json'
           const data = exportMoaHistory(undefined, { format, preset })
 
-          if (format === 'csv') {
-            res.writeHead(200, {
-              'Content-Type': 'text/csv; charset=utf-8',
-              'Content-Disposition': 'attachment; filename="moa-history.csv"',
-            })
-            res.end(data)
-            return
-          }
-
+          const isCsv = format === 'csv'
           res.writeHead(200, {
-            'Content-Type': 'application/json; charset=utf-8',
-            'Content-Disposition': 'attachment; filename="moa-history.json"',
+            'Content-Type': isCsv ? 'text/csv; charset=utf-8' : 'application/json; charset=utf-8',
+            'Content-Disposition': `attachment; filename="moa-history.${isCsv ? 'csv' : 'json'}"`,
           })
           res.end(data)
         } catch (err) {
@@ -570,6 +558,10 @@ ctx.effect(() => {
             writeJson(res, 400, { ok: false, error: 'MoA is disabled in settings' })
             return
           }
+          if (payload.timeMachineUrl && !isLoopbackUrl(payload.timeMachineUrl)) {
+            writeJson(res, 400, { ok: false, error: 'Invalid timeMachineUrl: loopback host required' })
+            return
+          }
           const presetName = payload.preset || cfg.default_preset || 'default'
           const preset = (cfg.presets || []).find((p) => p.name === presetName) || cfg.presets?.[0]
 
@@ -579,13 +571,17 @@ ctx.effect(() => {
             webServerPort: webServerPort || ctx.webServer?.port,
             timeMachineEngine: timeMachineEngine || ctx.reflect?.get?.('timeMachineEngine', false),
             timeMachineUrl: payload.timeMachineUrl, force: payload.force,
-            checkpoint: payload.checkpoint, checkpointFn: payload.checkpointFn,
+            checkpoint: payload.checkpoint,
             runId: payload.runId,
           })
 
           if (result?.skippedFiles > 0) {
             ctx.logger?.warn?.(`[dsh-moa] Workspace scan skipped ${result.skippedFiles} file(s): ${result.skippedList.join(', ')}`)
           }
+          if (result?.error) {
+            writeJson(res, 500, { ok: false, error: result.error?.message || String(result.error) })
+            return
+          }
 
           writeJson(res, 200, { ok: true, ...result })
         } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.43",
+  "version": "0.2.45",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",