@goodandready/dsh-moa 0.2.52 → 0.2.53

package/lib/file-workspace.js

@@ -403,9 +403,9 @@ export async function cleanMoaWorkspaces(baseDir, options = {}) {
   if (!baseDir) return
   const rawRunId = typeof options === 'string' ? options : options?.runId
   const safeRunId = rawRunId ? String(rawRunId).trim().replace(/[^a-zA-Z0-9_-]/g, '') : null
-  const moaRoot = path.join(baseDir, '.moa')
+  const moaRoot = assertPathContained(baseDir, '.moa')
   if (safeRunId) {
-    await bestEffort('cleanMoaWorkspaces runId', () => fs.rm(path.join(moaRoot, safeRunId), { recursive: true, force: true }))
+    await bestEffort('cleanMoaWorkspaces runId', () => fs.rm(assertPathContained(moaRoot, safeRunId), { recursive: true, force: true }))
     await bestEffort('clean empty moaRoot', async () => {
       if ((await fs.readdir(moaRoot)).length === 0) await fs.rmdir(moaRoot)
     })

package/lib/routes.js

@@ -3,8 +3,9 @@
  */
 
 import path from 'node:path'
-import { getMoaHistory, getMoaLeaderboard, getMoaRunById, exportMoaHistory } from './history.js'
-import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff, isSafeRelativePath, isLoopbackUrl } from './file-workspace.js'
+import os from 'node:os'
+import { getMoaHistory, getMoaLeaderboard, getMoaRunById, exportMoaHistory, isTestEnvironment } from './history.js'
+import { promoteCandidateWorkspace, readCandidateFiles, computeLineDiff, isSafeRelativePath, isLoopbackUrl, assertPathContained } from './file-workspace.js'
 import { isSafeWriteRequest } from './updater.js'
 import { runMoAPipeline } from './moa-runner.js'
 import { generateMoABenchmarkReport } from './moa-report.js'
@@ -30,7 +31,21 @@ function readBody(req) {
   })
 }
 
-export function registerMoaRoutes(ctx, { live, callLlm, liveCanvas, saveConfig, Config, plainConfig, webServerPort, timeMachineEngine }) {
+function isAllowedWorkspace(targetCwd, allowedRoots) {
+  if (!targetCwd || typeof targetCwd !== 'string') return false
+  for (const root of allowedRoots) {
+    if (!root) continue
+    try {
+      assertPathContained(root, targetCwd)
+      return true
+    } catch {
+      // not within root
+    }
+  }
+  return false
+}
+
+export function registerMoaRoutes(ctx, { live, callLlm, liveCanvas, saveConfig, Config, plainConfig, webServerPort, timeMachineEngine, workspaceRoot }) {
 
 ctx.effect(() => {
     return ctx.webServer.register({
@@ -535,13 +550,28 @@ ctx.effect(() => {
           const presetName = payload.preset || cfg.default_preset || 'default'
           const preset = (cfg.presets || []).find((p) => p.name === presetName) || cfg.presets?.[0]
 
+          const baseWorkspaceRoot = workspaceRoot || ctx.baseDir || ctx.workspaceDir || process.cwd()
+          const allowedRoots = [
+            baseWorkspaceRoot,
+            process.cwd(),
+            cfg.workspace_root,
+            ...(Array.isArray(cfg.allowed_workspaces) ? cfg.allowed_workspaces : (cfg.allowed_workspaces ? [cfg.allowed_workspaces] : [])),
+            ...(isTestEnvironment() ? [os.tmpdir()] : []),
+          ].filter(Boolean)
+
+          const targetCwd = payload.cwd ? path.resolve(payload.cwd) : baseWorkspaceRoot
+          if (payload.cwd && !isAllowedWorkspace(targetCwd, allowedRoots)) {
+            writeJson(res, 403, { ok: false, error: 'Forbidden: cwd escapes allowed workspace boundary' })
+            return
+          }
+
           const result = await runMoAPipeline({
             userPrompt: prompt, messages: payload.messages || [], preset, callLlm,
-            cwd: payload.cwd || process.cwd(), prices: cfg.prices || {}, liveCanvas,
+            cwd: targetCwd, prices: cfg.prices || {}, liveCanvas,
             webServerPort: webServerPort || ctx.webServer?.port,
             timeMachineEngine: timeMachineEngine || ctx.reflect?.get?.('timeMachineEngine', false),
-            timeMachineUrl: payload.timeMachineUrl, force: payload.force,
-            checkpoint: payload.checkpoint,
+            timeMachineUrl: payload.timeMachineUrl, force: false,
+            checkpoint: true,
             runId: payload.runId,
           })
 

package/lib/updater.js

@@ -44,8 +44,7 @@ export function isTrustedUpdateRequest(request) {
 /** General safe write check for plugin write endpoints (CSRF / Cross-Site protection, #234) */
 export function isSafeWriteRequest(request) {
   const remote = request?.socket?.remoteAddress || request?.connection?.remoteAddress;
-  const isLoop = !remote || isLoopback(remote);
-  if (!isLoop) return false;
+  if (!remote || !isLoopback(remote)) return false;
 
   const site = header(request, 'sec-fetch-site');
   if (site === 'cross-site') return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.52",
+  "version": "0.2.53",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",