@goodandready/dsh-moa 0.2.44 → 0.2.46

package/lib/routes.js

@@ -2,8 +2,9 @@
  * DeepSeek Harness Mixture of Agents (MoA) — HTTP Route Handlers
  */
 
+import path from 'node:path'
 import { getMoaHistory, getMoaLeaderboard, getMoaRunById, exportMoaHistory } from './history.js'
-import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff, isSafeRelativePath } from './file-workspace.js'
+import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff, isSafeRelativePath, isLoopbackUrl } from './file-workspace.js'
 import { isSafeWriteRequest } from './updater.js'
 import { runMoAPipeline } from './moa-runner.js'
 import { generateMoABenchmarkReport } from './moa-report.js'
@@ -36,10 +37,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/status',
       handler: (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const cfg = live()
           writeJson(res, 200, {
@@ -48,9 +46,7 @@ ctx.effect(() => {
             defaultPreset: cfg.default_preset || 'default',
             presetsCount: (cfg.presets || []).length,
           })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: status route')
@@ -61,10 +57,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/models',
       handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         if (_modelsCache.models.length > 0 && Date.now() - _modelsCache.timestamp < MODELS_CACHE_TTL) {
           writeJson(res, 200, { ok: true, models: _modelsCache.models, cached: true })
           return
@@ -123,19 +116,11 @@ ctx.effect(() => {
         // Query settings for configured providers
         try {
           let s = null
-          try {
-            s = ctx.get ? ctx.get('settings') : null
-          } catch {
-            s = null
-          }
-          const getSetting = (k) => {
-            try { return s?.get?.(k) } catch { return undefined }
-          }
+          try { s = ctx.get ? ctx.get('settings') : null } catch { s = null }
+          const getSetting = (k) => { try { return s?.get?.(k) } catch { return undefined } }
 
           const def = getSetting('agent-default-model')
-          if (def?.provider && def?.model) {
-            add(def.provider, def.model)
-          }
+          if (def?.provider && def?.model) add(def.provider, def.model)
 
           const piAi = getSetting('llm-pi-ai')
           for (const [pName, pData] of Object.entries(piAi?.providers || {})) {
@@ -208,25 +193,21 @@ ctx.effect(() => {
             }
 
             // Persist via saveConfig (in-memory and DSH profile settings)
+            let persistResult
             if (typeof saveConfig === 'function') {
-              try {
-                await saveConfig(validated)
-              } catch (perr) {
-                writeJson(res, 500, { ok: false, error: 'Settings persistence failed: ' + (perr?.message || String(perr)) })
-                return
-              }
+              try { persistResult = await saveConfig(validated) }
+              catch (perr) { return writeJson(res, 500, { ok: false, error: 'Settings persistence failed: ' + (perr?.message || String(perr)) }) }
             }
 
             const unwrapped = typeof plainConfig === 'function' ? plainConfig(validated) : validated
             writeJson(res, 200, {
               ok: true,
+              persisted: persistResult?.persisted ?? false,
               enabled: unwrapped.enabled !== false,
               defaultPreset: unwrapped.default_preset,
               presets: unwrapped.presets,
             })
-          } catch (err) {
-            writeJson(res, 400, { ok: false, error: err?.message || String(err) })
-          }
+          } catch (err) { writeJson(res, 400, { ok: false, error: err?.message || String(err) }) }
           return
         }
 
@@ -241,21 +222,14 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/history',
       handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const u = new URL(req.url, 'http://localhost')
-          const rawLimit = parseInt(u.searchParams.get('limit') || '20', 10)
-          const rawOffset = parseInt(u.searchParams.get('offset') || '0', 10)
-          const limit = Math.max(1, Math.min(100, Number.isFinite(rawLimit) ? rawLimit : 20))
-          const offset = Math.max(0, Number.isFinite(rawOffset) ? rawOffset : 0)
+          const limit = Math.max(1, Math.min(100, parseInt(u.searchParams.get('limit') || '20', 10) || 20))
+          const offset = Math.max(0, parseInt(u.searchParams.get('offset') || '0', 10) || 0)
           const data = getMoaHistory(limit, offset)
           writeJson(res, 200, { ok: true, ...data })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: history route')
@@ -266,10 +240,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/leaderboard',
       handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const url = new URL(req.url || '', 'http://127.0.0.1')
           const preset = url.searchParams.get('preset') || null
@@ -287,9 +258,7 @@ ctx.effect(() => {
 
           const data = getMoaLeaderboard(undefined, { preset })
           writeJson(res, 200, { ok: true, ...data })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: leaderboard route')
@@ -300,10 +269,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/promote',
       handler: async (req, res) => {
-        if (req.method !== 'POST') {
-          writeJson(res, 405, { ok: false, error: 'POST required' })
-          return
-        }
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST required' })
         if (!isSafeWriteRequest(req)) {
           writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
           return
@@ -316,19 +282,35 @@ ctx.effect(() => {
             writeJson(res, 400, { ok: false, error: 'Valid candidateIndex required (>= 1)' })
             return
           }
-          const cwd = body?.cwd || process.cwd()
           const runId = body?.runId
-          const promotedFiles = await promoteCandidateWorkspace(cwd, candidateIndex, {
-            runId,
+          let recordedRun = null
+          if (runId) {
+            recordedRun = getMoaRunById(runId)
+            if (!recordedRun) {
+              writeJson(res, 404, { ok: false, error: `Run '${runId}' not found` })
+              return
+            }
+          } else {
+            recordedRun = getMoaHistory(1, 0)?.runs?.[0] || null
+            if (!recordedRun) {
+              writeJson(res, 400, { ok: false, error: 'No recorded MoA run found' })
+              return
+            }
+          }
+          if (body?.cwd && path.resolve(body.cwd) !== path.resolve(recordedRun.cwd)) {
+            writeJson(res, 403, { ok: false, error: 'Forbidden: cwd does not match recorded run cwd' })
+            return
+          }
+          const effectiveCwd = recordedRun.cwd
+          const promotedFiles = await promoteCandidateWorkspace(effectiveCwd, candidateIndex, {
+            runId: runId ? recordedRun.id : undefined,
             keepMoa: true,
             port: ctx.webServer?.port,
             timeMachineEngine: timeMachineEngine || ctx.reflect?.get?.('timeMachineEngine', false),
             force: Boolean(body?.force),
           })
           writeJson(res, 200, { ok: true, candidateIndex, promotedFiles, checkpoint: promotedFiles?.checkpoint || null })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: promote candidate route')
@@ -339,17 +321,31 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/diff',
       handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const u = new URL(req.url, 'http://localhost')
           const rawRunId = u.searchParams.get('runId')
-          const latestRun = (!rawRunId || rawRunId === 'latest' || rawRunId === 'active') ? getMoaHistory(1, 0).runs[0] : null
-          const runId = (rawRunId && rawRunId !== 'latest' && rawRunId !== 'active') ? rawRunId : latestRun?.id
-          const run = runId ? getMoaRunById(runId) : null
-          const cwd = run?.cwd || latestRun?.cwd || u.searchParams.get('cwd') || process.cwd()
+          const queryCwd = u.searchParams.get('cwd')
+          let run = null
+          if (rawRunId && rawRunId !== 'latest' && rawRunId !== 'active') {
+            run = getMoaRunById(rawRunId)
+            if (!run) {
+              writeJson(res, 404, { ok: false, error: `Run '${rawRunId}' not found` })
+              return
+            }
+          } else {
+            run = getMoaHistory(1, 0)?.runs?.[0] || null
+            if (!run) {
+              writeJson(res, 404, { ok: false, error: 'No recorded MoA run found' })
+              return
+            }
+          }
+          if (queryCwd && path.resolve(queryCwd) !== path.resolve(run.cwd)) {
+            writeJson(res, 403, { ok: false, error: 'Forbidden: cwd does not match recorded run cwd' })
+            return
+          }
+          const runId = run.id
+          const cwd = run.cwd
           const sanitizeTarget = (val, def) => {
             const clean = String(val || '').trim().replace(/[^a-zA-Z0-9_-]/g, '')
             return clean || def
@@ -386,47 +382,31 @@ ctx.effect(() => {
             toSize: toItem?.size || 0,
             diff,
           })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: candidate diff route')
 
-
   // Route: /dsh-moa/history/export
   ctx.effect(() => {
     return ctx.webServer.register({
       kind: 'exact',
       path: '/dsh-moa/history/export',
       handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const url = new URL(req.url || '', 'http://127.0.0.1')
           const preset = url.searchParams.get('preset') || null
           const format = url.searchParams.get('format') || 'json'
           const data = exportMoaHistory(undefined, { format, preset })
 
-          if (format === 'csv') {
-            res.writeHead(200, {
-              'Content-Type': 'text/csv; charset=utf-8',
-              'Content-Disposition': 'attachment; filename="moa-history.csv"',
-            })
-            res.end(data)
-            return
-          }
-
+          const isCsv = format === 'csv'
           res.writeHead(200, {
-            'Content-Type': 'application/json; charset=utf-8',
-            'Content-Disposition': 'attachment; filename="moa-history.json"',
+            'Content-Type': isCsv ? 'text/csv; charset=utf-8' : 'application/json; charset=utf-8',
+            'Content-Disposition': `attachment; filename="moa-history.${isCsv ? 'csv' : 'json'}"`,
           })
           res.end(data)
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: history export route')
@@ -437,10 +417,7 @@ ctx.effect(() => {
       kind: 'prefix',
       path: '/dsh-moa/runs/',
       handler: (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         const urlPath = req.url.split('?')[0]
         const parts = urlPath.split('/').filter(Boolean)
         const runId = parts[2] || ''
@@ -485,10 +462,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/route-preset',
       handler: async (req, res) => {
-        if (req.method !== 'POST') {
-          writeJson(res, 405, { ok: false, error: 'POST required' })
-          return
-        }
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST required' })
         if (!isSafeWriteRequest(req)) {
           writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
           return
@@ -514,9 +488,7 @@ ctx.effect(() => {
             enabled: cfg.enabled !== false,
           })
           writeJson(res, 200, { ok: true, ...result })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: route preset endpoint')
@@ -530,10 +502,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/run',
       handler: async (req, res) => {
-        if (req.method !== 'POST') {
-          writeJson(res, 405, { ok: false, error: 'POST required' })
-          return
-        }
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST required' })
         if (!isSafeWriteRequest(req)) {
           writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
           return
@@ -559,6 +528,10 @@ ctx.effect(() => {
             writeJson(res, 400, { ok: false, error: 'MoA is disabled in settings' })
             return
           }
+          if (payload.timeMachineUrl && !isLoopbackUrl(payload.timeMachineUrl)) {
+            writeJson(res, 400, { ok: false, error: 'Invalid timeMachineUrl: loopback host required' })
+            return
+          }
           const presetName = payload.preset || cfg.default_preset || 'default'
           const preset = (cfg.presets || []).find((p) => p.name === presetName) || cfg.presets?.[0]
 
@@ -568,23 +541,20 @@ ctx.effect(() => {
             webServerPort: webServerPort || ctx.webServer?.port,
             timeMachineEngine: timeMachineEngine || ctx.reflect?.get?.('timeMachineEngine', false),
             timeMachineUrl: payload.timeMachineUrl, force: payload.force,
-            checkpoint: payload.checkpoint, checkpointFn: payload.checkpointFn,
+            checkpoint: payload.checkpoint,
             runId: payload.runId,
           })
 
           if (result?.skippedFiles > 0) {
             ctx.logger?.warn?.(`[dsh-moa] Workspace scan skipped ${result.skippedFiles} file(s): ${result.skippedList.join(', ')}`)
           }
-
           if (result?.error) {
             writeJson(res, 500, { ok: false, error: result.error?.message || String(result.error) })
             return
           }
 
           writeJson(res, 200, { ok: true, ...result })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: run pipeline route')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.44",
+  "version": "0.2.46",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",