@goodandready/dsh-moa 0.2.45 → 0.2.46

package/lib/file-workspace.js

@@ -302,6 +302,7 @@ export async function createPrePromotionCheckpoint(baseDir, candidateTarget, opt
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ label, cwd: baseDir }),
       signal: AbortSignal.timeout(options.timeoutMs ?? 1500),
+      redirect: 'error',
     })
     if (res.ok) {
       const data = await res.json()
@@ -563,15 +564,15 @@ export function computeLineDiff(oldText = '', newText = '') {
   const subOld = oldLines.slice(start, oldEnd + 1)
   const subNew = newLines.slice(start, newEnd + 1)
   const subN = subOld.length, subM = subNew.length
-  const middleItems = []
-
-  if (subN === 0) middleItems.push(...subNew.map((line, j) => ({ type: 'added', line, newNum: start + j + 1 })))
-  else if (subM === 0) middleItems.push(...subOld.map((line, i) => ({ type: 'removed', line, oldNum: start + i + 1 })))
-  else if (subN > 2000 || subM > 2000) {
-    middleItems.push(
-      ...subOld.map((line, i) => ({ type: 'removed', line, oldNum: start + i + 1 })),
-      ...subNew.map((line, j) => ({ type: 'added', line, newNum: start + j + 1 })),
-    )
+  let middleItems
+  if (subN === 0) {
+    middleItems = subNew.map((line, j) => ({ type: 'added', line, newNum: start + j + 1 }))
+  } else if (subM === 0) {
+    middleItems = subOld.map((line, i) => ({ type: 'removed', line, oldNum: start + i + 1 }))
+  } else if (subN > 2000 || subM > 2000) {
+    middleItems = new Array(subN + subM)
+    for (let i = 0; i < subN; i++) middleItems[i] = { type: 'removed', line: subOld[i], oldNum: start + i + 1 }
+    for (let j = 0; j < subM; j++) middleItems[subN + j] = { type: 'added', line: subNew[j], newNum: start + j + 1 }
   } else {
     const dp = Array.from({ length: subN + 1 }, () => new Uint16Array(subM + 1))
     for (let i = 0; i < subN; i++) {
@@ -587,8 +588,7 @@ export function computeLineDiff(oldText = '', newText = '') {
         stack.push({ type: 'removed', line: subOld[--i], oldNum: start + i + 1 })
       }
     }
-    middleItems.push(...stack.reverse())
+    middleItems = stack.reverse()
   }
-
-  return [...prefixItems, ...middleItems, ...suffixItems]
+  return prefixItems.concat(middleItems, suffixItems)
 }

package/lib/index.js

@@ -95,10 +95,21 @@ export function apply(ctx, config) {
 
   const saveConfig = async (newFields) => {
     const plain = plainConfig(newFields)
+    let persisted = false
     if (settingsService && typeof settingsService.replace === 'function') {
       await settingsService.replace(NS, plain)
+      persisted = true
     } else if (settingsService && typeof settingsService.update === 'function') {
       await settingsService.update(NS, plain)
+      persisted = true
+    }
+    if (config && typeof config === 'object') {
+      for (const [k, v] of Object.entries(plain)) {
+        if (config[k] && typeof config[k] === 'object' && typeof config[k].get === 'function') continue
+        const desc = Object.getOwnPropertyDescriptor(config, k)
+        if (desc && desc.get && !desc.set) continue
+        try { config[k] = v } catch {}
+      }
     }
     let liveCandidate = ctx.fiber?.config
     if (!liveCandidate && ('config' in ctx)) {
@@ -110,7 +121,7 @@ export function apply(ctx, config) {
       baseAtOverride[key] = JSON.stringify(currentLive[key])
     }
     localOverrides = { ...(localOverrides || {}), ...plain }
-    return live()
+    return { ok: true, persisted, ...live() }
   }
 
   const callLlm = createLlmCaller(ctx)

package/lib/moa-runner.js

@@ -27,13 +27,8 @@ export async function runMoAPipeline({
   messages = [],
   preset,
   callLlm,
-  cwd = process.cwd(),
-  prices = {},
-  onProgress = null,
-  historyFilePath = null,
-  liveCanvas = null,
-  onStreamDelta = null,
-  signal = null,
+  cwd = process.cwd(), prices = {}, onProgress = null,
+  historyFilePath = null, liveCanvas = null, onStreamDelta = null, signal = null,
   testGateEnabled = null, testCommand = null, execFn = null,
   webServerPort = null, timeMachineEngine = null, timeMachineUrl = null,
   force = isTestEnvironment() ? true : false, checkpoint = true, checkpointFn = null, runId: customRunId = null,
@@ -316,11 +311,7 @@ export async function runMoAPipeline({
     const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0)
     const r2Next = estimateRound2Cost(successfulRefs, prices, maxTokens)
     const downNext = estimateDownstreamCost(primaryJudge, preset?.judge_models, successfulRefs.length, prices, maxTokens)
-    const phaseCheck = checkPhaseBudget({
-      phaseName: 'Consilium Round 2', currentSpentUsd: currentSpent,
-      nextPhaseCostUsd: r2Next + downNext, maxBudgetUsd: preset.max_budget_usd,
-      action: preset.budget_action || 'trim', enabled: true,
-    })
+    const phaseCheck = checkPhaseBudget({ phaseName: 'Consilium Round 2', currentSpentUsd: currentSpent, nextPhaseCostUsd: r2Next + downNext, maxBudgetUsd: preset.max_budget_usd, action: preset.budget_action || 'trim', enabled: true })
     if (!phaseCheck.allowed) {
       if (phaseCheck.action === 'abort') {
         await cleanMoaWorkspaces(cwd, { runId })
@@ -416,12 +407,8 @@ export async function runMoAPipeline({
   if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0 && !isFastMode) {
     const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + (multiJudgeResult?.totalCostUsd || 0)
     const downNext = estimateDownstreamCost(primaryJudge, [], successfulRefs.length, prices, maxTokens)
-    const phaseCheck = checkPhaseBudget({
-      phaseName: 'Judge Synthesis', currentSpentUsd: currentSpent,
-      nextPhaseCostUsd: downNext, maxBudgetUsd: preset.max_budget_usd,
-      action: preset.budget_action || 'trim', enabled: true,
-    })
-    if (!phaseCheck.allowed) {
+    const phaseCheck = checkPhaseBudget({ phaseName: 'Judge Synthesis', currentSpentUsd: currentSpent, nextPhaseCostUsd: downNext, maxBudgetUsd: preset.max_budget_usd, action: preset.budget_action || 'trim', enabled: true })
+    if (!phaseCheck.allowed && fallbackJudges.length === 0) {
       await cleanMoaWorkspaces(cwd, { runId })
       return createBudgetAbortPayload({ reason: phaseCheck.reason, primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime })
     }
@@ -443,6 +430,18 @@ export async function runMoAPipeline({
     const currentJudge = judgesChain[jIdx]
     const currentLabel = slotLabel(currentJudge)
 
+    if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0 && !isFastMode) {
+      const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + (multiJudgeResult?.totalCostUsd || 0)
+      const judgeCost = estimateDownstreamCost(currentJudge, [], successfulRefs.length, prices, maxTokens)
+      const phaseCheck = checkPhaseBudget({ phaseName: `Judge Synthesis (${currentLabel})`, currentSpentUsd: currentSpent, nextPhaseCostUsd: judgeCost, maxBudgetUsd: preset.max_budget_usd, action: preset.budget_action || 'trim', enabled: true })
+      if (!phaseCheck.allowed) {
+        lastJudgeError = new Error(phaseCheck.reason)
+        logger.warn(`[dsh-moa] Judge ${currentLabel} budget check failed: ${phaseCheck.reason}`)
+        if (typeof onProgress === 'function') onProgress(`⚠️ *Judge ${currentLabel} skipped: exceeds budget limit.*\n`)
+        continue
+      }
+    }
+
     if (typeof onProgress === 'function') {
       const modeTitle = isCuratorSynthesis ? 'Curator' : 'Judge'
       const fallbackBadge = jIdx > 0 ? ` (Fallback #${jIdx})` : ''
@@ -487,6 +486,11 @@ export async function runMoAPipeline({
   }
 
   if (!judgeSuccess) {
+    if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0 && !isFastMode && (lastJudgeError?.message?.includes('exceeds max budget') || lastJudgeError?.message?.includes('Budget Guardrail') || preset?.budget_action === 'abort')) {
+      await cleanMoaWorkspaces(cwd, { runId })
+      const currentSpent = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0) + (multiJudgeResult?.totalCostUsd || 0)
+      return createBudgetAbortPayload({ reason: lastJudgeError?.message || 'Budget exceeded before judge synthesis', primaryJudge, referenceOutputs, currentSpentUsd: currentSpent, preset, isRefinement, isFastMode, collectedCtx, startTime })
+    }
     const firstErr = lastJudgeError ? (lastJudgeError.message || String(lastJudgeError)) : 'unknown error'
     synthesizedText = `⚠️ *[Aggregator error: ${firstErr}. Fallback candidate outputs:]*\n\n` +
       successfulRefs.map((r, i) => `### Candidate ${i + 1} (${r.label})\n${r.text}`).join('\n\n')

package/lib/moa-test-gate.js

@@ -43,8 +43,10 @@ export function resolveCandidateDir(baseDir, candidateIndex, options = {}) {
   }
 }
 
+const UNIX_ROOT_PREFIX = /^\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run|sbin|boot|Users|Applications|Library|System|Volumes|private)(?:\/|$)/
+
 /**
- * Validates that an executed script or command does not reference files outside allowed roots (#161).
+ * Validates that an executed script or command does not reference files outside allowed roots (#161, #225).
  */
 function scanPathTokensForLeak(text, allowedRoots, executionDir) {
   if (!text || typeof text !== 'string') return null
@@ -56,7 +58,10 @@ function scanPathTokensForLeak(text, allowedRoots, executionDir) {
     if (/^\/(usr\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\/|$)/.test(raw) && !/\.(txt|json|env|npmrc|key|ssh|md)/i.test(raw)) {
       continue
     }
-    if (!path.isAbsolute(raw) && !raw.startsWith('..')) continue
+    const isAbs = path.isAbsolute(raw)
+    const isUp = raw.startsWith('..')
+    if (!isAbs && !isUp) continue
+    if (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(raw)) continue
     const resolved = path.resolve(executionDir, raw)
     const allowed = allowedRoots.some((r) => r && (resolved === r || resolved.startsWith(r + path.sep)))
     if (!allowed) {
@@ -173,10 +178,10 @@ export async function runCandidateTestGate({
       }
 
       // 2. Scan script files referenced by command or present in candidate workspace (#161)
-      const candFiles = fsSync.existsSync(executionDir) ? fsSync.readdirSync(executionDir) : []
+      const candFiles = fsSync.existsSync(executionDir) ? fsSync.readdirSync(executionDir, { recursive: true }) : []
       const scriptTokens = new Set([
         ...cmdTokens.map((t) => t.replace(/^["']|["']$/g, '')),
-        ...candFiles,
+        ...candFiles.map((f) => String(f)),
       ])
 
       for (const scriptName of scriptTokens) {
@@ -251,19 +256,35 @@ export async function runCandidateTestGate({
 const cp = require('node:child_process');
 const path = require('node:path');
 const allowed = ${JSON.stringify(allowedReads)};
-function checkPath(p) {
+const UNIX_ROOT_PREFIX = /^\\/(?:home|root|etc|var|tmp|opt|mnt|srv|media|proc|sys|dev|usr|bin|lib|lib64|run|sbin|boot|Users|Applications|Library|System|Volumes|private)(?:\\/|$)/;
+function checkSinglePath(p) {
   if (!p || typeof p !== 'string') return true;
   if (/^\\/(usr\\/(bin|lib|include)|bin|lib|lib64|etc|dev)(\\/|$)/.test(p) && !/\\.(txt|json|env|npmrc|key|ssh|md)/i.test(p)) return true;
+  const isAbs = path.isAbsolute(p);
+  const isUp = p.startsWith('..');
+  if (!isAbs && !isUp) return true;
+  if (isAbs && process.platform !== 'win32' && !UNIX_ROOT_PREFIX.test(p)) return true;
   const res = path.resolve(process.cwd(), p);
   return allowed.some(root => root && (res === root || res.startsWith(root + path.sep)));
 }
+function scanStringForPaths(str) {
+  if (!str || typeof str !== 'string') return true;
+  if (!checkSinglePath(str)) return false;
+  const matches = str.match(/(?:[a-zA-Z]:[\\\\/][^\\s"'<>]+|(?<![\\w.@/\\\\])\\/(?:[a-zA-Z0-9_\\-.]+\\/)*[a-zA-Z0-9_\\-.]+|(?<![\\w.@/\\\\])\\.\\.[\\\\/][^\\s"'<>]*)/g) || [];
+  for (const m of matches) {
+    if (!checkSinglePath(m)) return false;
+  }
+  return true;
+}
 function guardArgs(cmd, args) {
-  if (cmd && typeof cmd === 'string' && !checkPath(cmd)) {
-    throw new Error('ERR_ACCESS_DENIED: child process binary outside sandbox: ' + cmd);
+  if (cmd && !scanStringForPaths(String(cmd))) {
+    throw new Error('ERR_ACCESS_DENIED: child process command outside sandbox: ' + cmd);
   }
   if (Array.isArray(args)) {
     for (const a of args) {
-      if (!checkPath(a)) throw new Error('ERR_ACCESS_DENIED: child process argument outside sandbox: ' + a);
+      if (a && !scanStringForPaths(String(a))) {
+        throw new Error('ERR_ACCESS_DENIED: child process argument outside sandbox: ' + a);
+      }
     }
   }
 }

package/lib/routes.js

@@ -37,10 +37,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/status',
       handler: (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const cfg = live()
           writeJson(res, 200, {
@@ -49,9 +46,7 @@ ctx.effect(() => {
             defaultPreset: cfg.default_preset || 'default',
             presetsCount: (cfg.presets || []).length,
           })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: status route')
@@ -62,10 +57,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/models',
       handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         if (_modelsCache.models.length > 0 && Date.now() - _modelsCache.timestamp < MODELS_CACHE_TTL) {
           writeJson(res, 200, { ok: true, models: _modelsCache.models, cached: true })
           return
@@ -201,21 +193,21 @@ ctx.effect(() => {
             }
 
             // Persist via saveConfig (in-memory and DSH profile settings)
+            let persistResult
             if (typeof saveConfig === 'function') {
-              try { await saveConfig(validated) }
+              try { persistResult = await saveConfig(validated) }
               catch (perr) { return writeJson(res, 500, { ok: false, error: 'Settings persistence failed: ' + (perr?.message || String(perr)) }) }
             }
 
             const unwrapped = typeof plainConfig === 'function' ? plainConfig(validated) : validated
             writeJson(res, 200, {
               ok: true,
+              persisted: persistResult?.persisted ?? false,
               enabled: unwrapped.enabled !== false,
               defaultPreset: unwrapped.default_preset,
               presets: unwrapped.presets,
             })
-          } catch (err) {
-            writeJson(res, 400, { ok: false, error: err?.message || String(err) })
-          }
+          } catch (err) { writeJson(res, 400, { ok: false, error: err?.message || String(err) }) }
           return
         }
 
@@ -230,19 +222,14 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/history',
       handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const u = new URL(req.url, 'http://localhost')
           const limit = Math.max(1, Math.min(100, parseInt(u.searchParams.get('limit') || '20', 10) || 20))
           const offset = Math.max(0, parseInt(u.searchParams.get('offset') || '0', 10) || 0)
           const data = getMoaHistory(limit, offset)
           writeJson(res, 200, { ok: true, ...data })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: history route')
@@ -253,10 +240,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/leaderboard',
       handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const url = new URL(req.url || '', 'http://127.0.0.1')
           const preset = url.searchParams.get('preset') || null
@@ -274,9 +258,7 @@ ctx.effect(() => {
 
           const data = getMoaLeaderboard(undefined, { preset })
           writeJson(res, 200, { ok: true, ...data })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: leaderboard route')
@@ -287,10 +269,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/promote',
       handler: async (req, res) => {
-        if (req.method !== 'POST') {
-          writeJson(res, 405, { ok: false, error: 'POST required' })
-          return
-        }
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST required' })
         if (!isSafeWriteRequest(req)) {
           writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
           return
@@ -303,26 +282,35 @@ ctx.effect(() => {
             writeJson(res, 400, { ok: false, error: 'Valid candidateIndex required (>= 1)' })
             return
           }
-          const cwd = body?.cwd || process.cwd()
           const runId = body?.runId
+          let recordedRun = null
           if (runId) {
-            const recordedRun = getMoaRunById(runId)
-            if (recordedRun && body?.cwd && path.resolve(body.cwd) !== path.resolve(recordedRun.cwd)) {
-              writeJson(res, 403, { ok: false, error: 'Forbidden: cwd does not match recorded run cwd' })
+            recordedRun = getMoaRunById(runId)
+            if (!recordedRun) {
+              writeJson(res, 404, { ok: false, error: `Run '${runId}' not found` })
+              return
+            }
+          } else {
+            recordedRun = getMoaHistory(1, 0)?.runs?.[0] || null
+            if (!recordedRun) {
+              writeJson(res, 400, { ok: false, error: 'No recorded MoA run found' })
               return
             }
           }
-          const promotedFiles = await promoteCandidateWorkspace(cwd, candidateIndex, {
-            runId,
+          if (body?.cwd && path.resolve(body.cwd) !== path.resolve(recordedRun.cwd)) {
+            writeJson(res, 403, { ok: false, error: 'Forbidden: cwd does not match recorded run cwd' })
+            return
+          }
+          const effectiveCwd = recordedRun.cwd
+          const promotedFiles = await promoteCandidateWorkspace(effectiveCwd, candidateIndex, {
+            runId: runId ? recordedRun.id : undefined,
             keepMoa: true,
             port: ctx.webServer?.port,
             timeMachineEngine: timeMachineEngine || ctx.reflect?.get?.('timeMachineEngine', false),
             force: Boolean(body?.force),
           })
           writeJson(res, 200, { ok: true, candidateIndex, promotedFiles, checkpoint: promotedFiles?.checkpoint || null })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: promote candidate route')
@@ -333,10 +321,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/diff',
       handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const u = new URL(req.url, 'http://localhost')
           const rawRunId = u.searchParams.get('runId')
@@ -349,14 +334,18 @@ ctx.effect(() => {
               return
             }
           } else {
-            run = getMoaHistory(1, 0).runs[0] || null
+            run = getMoaHistory(1, 0)?.runs?.[0] || null
+            if (!run) {
+              writeJson(res, 404, { ok: false, error: 'No recorded MoA run found' })
+              return
+            }
           }
-          if (run && queryCwd && path.resolve(queryCwd) !== path.resolve(run.cwd)) {
+          if (queryCwd && path.resolve(queryCwd) !== path.resolve(run.cwd)) {
             writeJson(res, 403, { ok: false, error: 'Forbidden: cwd does not match recorded run cwd' })
             return
           }
-          const runId = run?.id
-          const cwd = run?.cwd || queryCwd || process.cwd()
+          const runId = run.id
+          const cwd = run.cwd
           const sanitizeTarget = (val, def) => {
             const clean = String(val || '').trim().replace(/[^a-zA-Z0-9_-]/g, '')
             return clean || def
@@ -393,24 +382,18 @@ ctx.effect(() => {
             toSize: toItem?.size || 0,
             diff,
           })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: candidate diff route')
 
-
   // Route: /dsh-moa/history/export
   ctx.effect(() => {
     return ctx.webServer.register({
       kind: 'exact',
       path: '/dsh-moa/history/export',
       handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         try {
           const url = new URL(req.url || '', 'http://127.0.0.1')
           const preset = url.searchParams.get('preset') || null
@@ -423,9 +406,7 @@ ctx.effect(() => {
             'Content-Disposition': `attachment; filename="moa-history.${isCsv ? 'csv' : 'json'}"`,
           })
           res.end(data)
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: history export route')
@@ -436,10 +417,7 @@ ctx.effect(() => {
       kind: 'prefix',
       path: '/dsh-moa/runs/',
       handler: (req, res) => {
-        if (req.method !== 'GET') {
-          writeJson(res, 405, { ok: false, error: 'GET required' })
-          return
-        }
+        if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET required' })
         const urlPath = req.url.split('?')[0]
         const parts = urlPath.split('/').filter(Boolean)
         const runId = parts[2] || ''
@@ -484,10 +462,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/route-preset',
       handler: async (req, res) => {
-        if (req.method !== 'POST') {
-          writeJson(res, 405, { ok: false, error: 'POST required' })
-          return
-        }
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST required' })
         if (!isSafeWriteRequest(req)) {
           writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
           return
@@ -513,9 +488,7 @@ ctx.effect(() => {
             enabled: cfg.enabled !== false,
           })
           writeJson(res, 200, { ok: true, ...result })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: route preset endpoint')
@@ -529,10 +502,7 @@ ctx.effect(() => {
       kind: 'exact',
       path: '/dsh-moa/run',
       handler: async (req, res) => {
-        if (req.method !== 'POST') {
-          writeJson(res, 405, { ok: false, error: 'POST required' })
-          return
-        }
+        if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST required' })
         if (!isSafeWriteRequest(req)) {
           writeJson(res, 403, { ok: false, error: 'Forbidden: cross-site request rejected' })
           return
@@ -584,9 +554,7 @@ ctx.effect(() => {
           }
 
           writeJson(res, 200, { ok: true, ...result })
-        } catch (err) {
-          writeJson(res, 500, { ok: false, error: err?.message || String(err) })
-        }
+        } catch (err) { writeJson(res, 500, { ok: false, error: err?.message || String(err) }) }
       },
     })
   }, 'dsh-moa: run pipeline route')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.45",
+  "version": "0.2.46",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",