@goodandready/dsh-moa 0.2.51 → 0.2.53

package/lib/file-workspace.js

@@ -403,9 +403,9 @@ export async function cleanMoaWorkspaces(baseDir, options = {}) {
   if (!baseDir) return
   const rawRunId = typeof options === 'string' ? options : options?.runId
   const safeRunId = rawRunId ? String(rawRunId).trim().replace(/[^a-zA-Z0-9_-]/g, '') : null
-  const moaRoot = path.join(baseDir, '.moa')
+  const moaRoot = assertPathContained(baseDir, '.moa')
   if (safeRunId) {
-    await bestEffort('cleanMoaWorkspaces runId', () => fs.rm(path.join(moaRoot, safeRunId), { recursive: true, force: true }))
+    await bestEffort('cleanMoaWorkspaces runId', () => fs.rm(assertPathContained(moaRoot, safeRunId), { recursive: true, force: true }))
     await bestEffort('clean empty moaRoot', async () => {
       if ((await fs.readdir(moaRoot)).length === 0) await fs.rmdir(moaRoot)
     })

package/lib/moa-budget.js

@@ -87,15 +87,38 @@ export function estimatePanelCost(judges = [], numCandidates = 1, prices = {}, m
  * Calculates accurate synthesis prompt tokens accounting for full user prompt,
  * judge criteria, and reference candidate texts (#158).
  */
-export function calcSynthesisPromptTokens(userPrompt = '', referenceOutputs = [], judgeCriteria = '', overhead = 2600, options = {}) {
-  const opts = (typeof overhead === 'object' && overhead !== null) ? overhead : (options || {})
-  const baseOverhead = typeof overhead === 'number' ? overhead : 2600
-  let promptChars = (typeof userPrompt === 'string' ? userPrompt.length : 0) +
-    (typeof judgeCriteria === 'string' ? judgeCriteria.length : 0) +
-    baseOverhead
+export function calcSynthesisPromptTokens(firstArg = '', maybeRefs = [], maybeCriteria = '', maybeOverhead = 2600, maybeOptions = {}) {
+  let userPrompt, referenceOutputs, judgeCriteria, projectContext, priorTurnBaseline, consensusReport, compositeMergeDirective, baseOverhead
+
+  if (typeof firstArg === 'object' && firstArg !== null) {
+    userPrompt = firstArg.userPrompt || ''
+    referenceOutputs = firstArg.referenceOutputs || []
+    judgeCriteria = firstArg.judgeCriteria || ''
+    projectContext = firstArg.projectContext || ''
+    priorTurnBaseline = firstArg.priorTurnBaseline
+    consensusReport = firstArg.consensusReport
+    compositeMergeDirective = firstArg.compositeMergeDirective
+    baseOverhead = typeof firstArg.overhead === 'number' ? firstArg.overhead : 2600
+  } else {
+    userPrompt = typeof firstArg === 'string' ? firstArg : ''
+    referenceOutputs = Array.isArray(maybeRefs) ? maybeRefs : []
+    judgeCriteria = typeof maybeCriteria === 'string' ? maybeCriteria : ''
+    const opts = (typeof maybeOverhead === 'object' && maybeOverhead !== null) ? maybeOverhead : (maybeOptions || {})
+    projectContext = opts.projectContext || ''
+    priorTurnBaseline = opts.priorTurnBaseline
+    consensusReport = opts.consensusReport
+    compositeMergeDirective = opts.compositeMergeDirective
+    baseOverhead = typeof maybeOverhead === 'number' ? maybeOverhead : 2600
+  }
+
+  let promptChars = userPrompt.length + judgeCriteria.length + (projectContext?.length || 0) + baseOverhead
 
   if (Array.isArray(referenceOutputs)) {
+    if (referenceOutputs.some((r) => r && r.testResult)) {
+      promptChars += 550 // TEST_GATE_DIRECTIVE overhead
+    }
     for (const r of referenceOutputs) {
+      if (!r) continue
       promptChars += (r.text?.length || 0)
       if (r.testResult) {
         promptChars += 150 + (r.testResult.output?.length || 0)
@@ -105,12 +128,12 @@ export function calcSynthesisPromptTokens(userPrompt = '', referenceOutputs = []
       }
     }
   }
-  if (opts.priorTurnBaseline) promptChars += opts.priorTurnBaseline.length + 50
-  if (opts.consensusReport) {
-    const crText = typeof opts.consensusReport === 'string' ? opts.consensusReport : JSON.stringify(opts.consensusReport)
+  if (priorTurnBaseline) promptChars += priorTurnBaseline.length + 50
+  if (consensusReport) {
+    const crText = typeof consensusReport === 'string' ? consensusReport : JSON.stringify(consensusReport)
     promptChars += crText.length + 50
   }
-  if (opts.compositeMergeDirective) promptChars += opts.compositeMergeDirective.length + 50
+  if (compositeMergeDirective) promptChars += compositeMergeDirective.length + 50
 
   return Math.max(50, Math.ceil(promptChars / 4))
 }
@@ -301,8 +324,23 @@ export function createBudgetAbortPayload({
   multiJudgeResult = null,
 }) {
   const aggLabel = (primaryJudge?.provider && primaryJudge?.model) ? `${primaryJudge.provider}:${primaryJudge.model}` : "none";
-  const refTokens = referenceOutputs.reduce((acc, r) => acc + (r.usage?.totalTokens || 0), 0);
-  const panelTokens = multiJudgeResult?.totalUsage?.totalTokens || 0;
+  const refTokens = referenceOutputs.reduce((acc, r) => acc + (r.usage?.totalTokens ?? ((r.usage?.inputTokens || 0) + (r.usage?.outputTokens || 0))), 0);
+  const refInTokens = referenceOutputs.reduce((acc, r) => acc + (r.usage?.inputTokens || r.usage?.promptTokens || 0), 0);
+  const refOutTokens = referenceOutputs.reduce((acc, r) => acc + (r.usage?.outputTokens || r.usage?.completionTokens || 0), 0);
+
+  const mjUsage = multiJudgeResult?.totalUsage;
+  const panelTokens = mjUsage?.totalTokens ?? ((mjUsage?.inputTokens || 0) + (mjUsage?.outputTokens || 0));
+  const panelInTokens = mjUsage?.inputTokens || mjUsage?.promptTokens || 0;
+  const panelOutTokens = mjUsage?.outputTokens || mjUsage?.completionTokens || 0;
+  const panelCostUsd = mjUsage?.costUsd || multiJudgeResult?.totalCostUsd || 0;
+
+  const refCost = referenceOutputs.reduce((acc, r) => acc + (r.costUsd || 0), 0);
+  const totalCostUsd = Number(Math.max(currentSpentUsd, refCost + panelCostUsd).toFixed(5));
+
+  const totalTokens = refTokens + panelTokens;
+  const totalInputTokens = refInTokens + panelInTokens;
+  const totalOutputTokens = refOutTokens + panelOutTokens;
+
   return {
     kind: "failure",
     content: `🛑 Budget Guardrail Abort: ${reason}`,
@@ -315,11 +353,13 @@ export function createBudgetAbortPayload({
     winnerModel: "none",
     promotedFiles: [],
     usage: {
-      totalTokens: refTokens + panelTokens,
-      totalCostUsd: Number(currentSpentUsd.toFixed(5)),
+      totalTokens,
+      totalInputTokens,
+      totalOutputTokens,
+      totalCostUsd,
       candidates: referenceOutputs.map((r) => ({ label: r.label, usage: r.usage, costUsd: r.costUsd })),
       aggregator: { inputTokens: 0, outputTokens: 0, totalTokens: 0, costUsd: 0 },
-      ...(multiJudgeResult ? { multiJudge: multiJudgeResult.totalUsage || { totalTokens: panelTokens } } : {}),
+      ...(multiJudgeResult ? { multiJudge: mjUsage || { inputTokens: panelInTokens, outputTokens: panelOutTokens, totalTokens: panelTokens, costUsd: panelCostUsd } } : {}),
     },
     multiJudgeResult: multiJudgeResult || undefined,
     skippedFiles: collectedCtx?.skippedFiles || 0,

package/lib/moa-multi-judge.js

@@ -420,7 +420,11 @@ export async function runMultiJudgePhase({
   const panelMaxTokens = Math.min(typeof preset.max_tokens === 'number' && preset.max_tokens > 0 ? preset.max_tokens : 2048, 2048)
 
   if (preset?.budget_guard_enabled && preset?.max_budget_usd > 0) {
-    const promptTokens = calcSynthesisPromptTokens(userPrompt, successfulRefs, judgeCriteria)
+    const promptTokens = calcSynthesisPromptTokens({
+      userPrompt,
+      referenceOutputs: successfulRefs,
+      judgeCriteria,
+    })
     const panelEst = estimatePanelCost(panelJudges, successfulRefs.length, prices, panelMaxTokens, promptTokens)
     const downEst = estimateDownstreamCost(primaryJudge, [], successfulRefs.length, prices, maxTokens, promptTokens)
     const phaseCheck = checkPhaseBudget({

package/lib/routes.js

@@ -3,8 +3,9 @@
  */
 
 import path from 'node:path'
-import { getMoaHistory, getMoaLeaderboard, getMoaRunById, exportMoaHistory } from './history.js'
-import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff, isSafeRelativePath, isLoopbackUrl } from './file-workspace.js'
+import os from 'node:os'
+import { getMoaHistory, getMoaLeaderboard, getMoaRunById, exportMoaHistory, isTestEnvironment } from './history.js'
+import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff, isSafeRelativePath, isLoopbackUrl, assertPathContained } from './file-workspace.js'
 import { isSafeWriteRequest } from './updater.js'
 import { runMoAPipeline } from './moa-runner.js'
 import { generateMoABenchmarkReport } from './moa-report.js'
@@ -30,7 +31,21 @@ function readBody(req) {
   })
 }
 
-export function registerMoaRoutes(ctx, { live, callLlm, liveCanvas, saveConfig, Config, plainConfig, webServerPort, timeMachineEngine }) {
+function isAllowedWorkspace(targetCwd, allowedRoots) {
+  if (!targetCwd || typeof targetCwd !== 'string') return false
+  for (const root of allowedRoots) {
+    if (!root) continue
+    try {
+      assertPathContained(root, targetCwd)
+      return true
+    } catch {
+      // not within root
+    }
+  }
+  return false
+}
+
+export function registerMoaRoutes(ctx, { live, callLlm, liveCanvas, saveConfig, Config, plainConfig, webServerPort, timeMachineEngine, workspaceRoot }) {
 
 ctx.effect(() => {
     return ctx.webServer.register({
@@ -535,13 +550,28 @@ ctx.effect(() => {
           const presetName = payload.preset || cfg.default_preset || 'default'
           const preset = (cfg.presets || []).find((p) => p.name === presetName) || cfg.presets?.[0]
 
+          const baseWorkspaceRoot = workspaceRoot || ctx.baseDir || ctx.workspaceDir || process.cwd()
+          const allowedRoots = [
+            baseWorkspaceRoot,
+            process.cwd(),
+            cfg.workspace_root,
+            ...(Array.isArray(cfg.allowed_workspaces) ? cfg.allowed_workspaces : (cfg.allowed_workspaces ? [cfg.allowed_workspaces] : [])),
+            ...(isTestEnvironment() ? [os.tmpdir()] : []),
+          ].filter(Boolean)
+
+          const targetCwd = payload.cwd ? path.resolve(payload.cwd) : baseWorkspaceRoot
+          if (payload.cwd && !isAllowedWorkspace(targetCwd, allowedRoots)) {
+            writeJson(res, 403, { ok: false, error: 'Forbidden: cwd escapes allowed workspace boundary' })
+            return
+          }
+
           const result = await runMoAPipeline({
             userPrompt: prompt, messages: payload.messages || [], preset, callLlm,
-            cwd: payload.cwd || process.cwd(), prices: cfg.prices || {}, liveCanvas,
+            cwd: targetCwd, prices: cfg.prices || {}, liveCanvas,
             webServerPort: webServerPort || ctx.webServer?.port,
             timeMachineEngine: timeMachineEngine || ctx.reflect?.get?.('timeMachineEngine', false),
-            timeMachineUrl: payload.timeMachineUrl, force: payload.force,
-            checkpoint: payload.checkpoint,
+            timeMachineUrl: payload.timeMachineUrl, force: false,
+            checkpoint: true,
             runId: payload.runId,
           })
 

package/lib/updater.js

@@ -44,8 +44,7 @@ export function isTrustedUpdateRequest(request) {
 /** General safe write check for plugin write endpoints (CSRF / Cross-Site protection, #234) */
 export function isSafeWriteRequest(request) {
   const remote = request?.socket?.remoteAddress || request?.connection?.remoteAddress;
-  const isLoop = !remote || isLoopback(remote);
-  if (!isLoop) return false;
+  if (!remote || !isLoopback(remote)) return false;
 
   const site = header(request, 'sec-fetch-site');
   if (site === 'cross-site') return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.51",
+  "version": "0.2.53",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",