tina4ruby 3.13.93 → 3.13.96

data/lib/tina4/dev_admin.rb

@@ -467,18 +467,13 @@ module Tina4
         when ["GET", "/__dev/api/system"]
           json_response(system_payload)
         when ["GET", "/__dev/api/queue/topics"]
-          queue_dir = File.join(Dir.pwd, "data", "queue")
-          topics = Dir.exist?(queue_dir) ? Dir.children(queue_dir).select { |d| File.directory?(File.join(queue_dir, d)) }.sort : []
-          topics = ["default"] if topics.empty?
-          json_response({ topics: topics })
+          json_response({ topics: queue_topics })
         when ["GET", "/__dev/api/queue/dead-letters"]
           topic = query_param(env, "topic") || "default"
-          jobs = []
-          begin
-            queue = Tina4::Queue.new(backend: :file, topic: topic) if defined?(Tina4::Queue)
-            jobs = queue.respond_to?(:dead_letters) ? queue.dead_letters.map { |j| j.merge(status: "dead_letter") } : []
-          rescue StandardError => e
-            jobs = []
+          jobs = begin
+            queue_dead_letters(topic)
+          rescue StandardError
+            []
           end
           json_response({ jobs: jobs, count: jobs.size, topic: topic })
         when ["GET", "/__dev/api/queue"]
@@ -492,15 +487,14 @@ module Tina4
               # positionally raises ArgumentError, which the rescue below
               # swallows — silently zeroing every stat. Use keyword form.
               stats = {
-                pending: queue.respond_to?(:size) ? queue.size(status: "pending") : 0,
-                completed: queue.respond_to?(:size) ? queue.size(status: "completed") : 0,
-                failed: queue.respond_to?(:size) ? queue.size(status: "failed") : 0,
-                reserved: queue.respond_to?(:size) ? queue.size(status: "reserved") : 0,
+                pending: queue.size(status: "pending"),
+                completed: queue.size(status: "completed"),
+                failed: queue.size(status: "failed"),
+                reserved: queue.size(status: "reserved"),
               }
-              jobs.concat(queue.failed.map { |j| j.merge(status: "failed") }) if queue.respond_to?(:failed)
-              jobs.concat(queue.dead_letters.map { |j| j.merge(status: "dead_letter") }) if queue.respond_to?(:dead_letters)
+              jobs = queue_jobs(topic, query_param(env, "status"))
             end
-          rescue StandardError => e
+          rescue StandardError
             # fall through to empty stats
           end
           json_response({ jobs: jobs, stats: stats })
@@ -631,10 +625,25 @@ module Tina4
         when ["GET", "/__dev/api/metrics"]
           json_response(Tina4::Metrics.quick_metrics)
         when ["GET", "/__dev/api/metrics/full"]
-          json_response(Tina4::Metrics.full_analysis)
+          # No fallback (ADR-0002). A missing or stale CLI is a 503 naming the
+          # install command, never zeros that read as a healthy codebase.
+          begin
+            json_response(Tina4::Metrics.full_analysis)
+          rescue Tina4::MetricsEngineError => e
+            json_response({ "error" => e.message }, 503)
+          end
         when ["GET", "/__dev/api/metrics/file"]
           file_path = (query_param(env, "path") || "").to_s
-          json_response(Tina4::Metrics.file_detail(file_path))
+          begin
+            json_response(Tina4::Metrics.file_detail(file_path))
+          rescue Tina4::MetricsEngineError => e
+            # A bad path is the caller's mistake (404); anything else is the
+            # engine being unavailable (503).
+            bad_path = e.message.include?("no such file") ||
+                       e.message.include?("not a file") ||
+                       e.message.include?("needs a path")
+            json_response({ "error" => e.message }, bad_path ? 404 : 503)
+          end
         when ["GET", "/__dev/api/thoughts"]
           json_response(thoughts_payload)
         when ["POST", "/__dev/api/supervise/create"]
@@ -805,7 +814,16 @@ module Tina4
           platform: RUBY_PLATFORM,
           debug: ENV["TINA4_DEBUG"] || "false",
           log_level: ENV["TINA4_LOG_LEVEL"] || "ERROR",
-          database: ENV["TINA4_DATABASE_URL"] || "not configured",
+          # REDACTED, not raw. Measured 2026-08-02: this served
+          # TINA4_DATABASE_URL verbatim, so GET /__dev/api/status answered any
+          # caller that could reach the debug port with the database password.
+          # It is a display field - nothing round-trips it back - so the safe
+          # form is strictly better here. (The connections EDITOR at
+          # /__dev/api/connections still returns the raw URL on purpose: it
+          # populates a form that is saved back to .env, and redacting it there
+          # would write *** into the file. That one needs an unchanged-sentinel
+          # design, in all four frameworks.)
+          database: (ENV["TINA4_DATABASE_URL"].to_s.empty? ? "not configured" : Tina4::DatabaseUrl.redact(ENV["TINA4_DATABASE_URL"])),
           db_tables: db_table_count,
           uptime: (Time.now - (defined?(@boot_time) && @boot_time ? @boot_time : (@boot_time = Time.now))).round(1),
           route_count: Tina4::Router.routes.size,
@@ -1053,6 +1071,86 @@ module Tina4
         { ok: false, error: e.message }
       end
 
+      # ── Queue panel: the list must describe the set the stats count ──
+      #
+      # Every reader below goes through Tina4::Queue.base_path / .topic_path,
+      # or through the backend itself — the SAME answers the lite backend
+      # writes to and Queue#size counts. These handlers used to re-derive the
+      # path as
+      # Dir.pwd/data/queue, which no Ruby app ever wrote to, so the topic list
+      # could not name a real topic and the job list described a store that was
+      # not the one being counted.
+      #
+      # Each job appears EXACTLY ONCE, in the bucket its OWN stat counts it in:
+      #
+      #   stats.pending   <- <base>/<topic>/*.queue-data
+      #   stats.reserved  <- <base>/<topic>/reserved/*.queue-data
+      #   stats.failed    <- <base>/dead_letter/*.queue-data tagged with topic
+      #   stats.completed <- always 0; the file backend deletes on complete
+      #
+      # so sum(stats) == jobs.length by construction on a quiescent store, and
+      # every ?status= filter returns exactly what its own stat counts.
+
+      # Topic directories in the real store. The shared dead-letter directory
+      # is a sibling of the topic directories, not a topic.
+      def queue_topics
+        base = Tina4::Queue.base_path
+        return ["default"] unless Dir.exist?(base)
+
+        topics = Dir.children(base)
+                    .select { |entry| File.directory?(File.join(base, entry)) }
+                    .reject { |entry| entry == Tina4::Queue::DEAD_LETTER_DIRNAME }
+                    .sort
+        topics.empty? ? ["default"] : topics
+      rescue StandardError
+        ["default"]
+      end
+
+      # Jobs for +topic+, optionally narrowed to one bucket.
+      def queue_jobs(topic, status_filter = nil)
+        wanted = status_filter.to_s.strip
+        topic_dir = Tina4::Queue.topic_path(topic)
+        jobs = []
+        jobs.concat(read_queue_dir(topic_dir, "pending")) if wanted.empty? || wanted == "pending"
+        if wanted.empty? || wanted == "reserved"
+          jobs.concat(read_queue_dir(File.join(topic_dir, "reserved"), "reserved"))
+        end
+        jobs.concat(queue_dead_letters(topic)) if wanted.empty? || wanted == "failed" || wanted == "dead"
+        jobs
+      end
+
+      # Read one queue directory the way Queue#size COUNTS it. size globs the
+      # files without parsing them, so a job file that cannot be parsed still
+      # counts — and must therefore still be LISTED, or the panel shows a total
+      # it cannot account for. Listing it is also the only way an operator ever
+      # learns the file is there.
+      def read_queue_dir(dir, status)
+        return [] unless Dir.exist?(dir)
+
+        Tina4::Queue.job_files(dir).filter_map do |file|
+          begin
+            JSON.parse(File.read(file)).merge("status" => status)
+          rescue JSON::ParserError
+            { "id" => File.basename(file, Tina4::Queue::JOB_EXTENSION), "status" => status,
+              "error" => "unreadable job file" }
+          rescue Errno::ENOENT
+            nil # consumed between the glob and the read
+          end
+        end
+      end
+
+      # Every dead letter for +topic+ — the same set stats.failed counts.
+      #
+      # max_retries: 0 is the established "no attempt-count filter" spelling
+      # (the `tina4ruby queue retry` command uses it for the same reason). The
+      # DEFAULT filters on the max_retries of the Queue this dev admin happened
+      # to construct, which is 3 and has nothing to do with the app's: an app
+      # configured max_retries: 1 dead-letters a job at ONE attempt, and every
+      # one of those was counted by stats.failed and never listed.
+      def queue_dead_letters(topic)
+        dev_queue(topic).dead_letters(max_retries: 0).map { |job| job.merge("status" => "dead_letter") }
+      end
+
       # ── Queue run-chips (Tier 3) ───────────────────────────────────
 
       # A file-backed dev Queue for +topic+ (matches the GET /queue handler).

data/lib/tina4/dev_mailbox.rb

@@ -16,7 +16,10 @@ module Tina4
     end
 
     # Capture an outgoing email to the local filesystem instead of sending
-    def capture(to:, subject:, body:, html: false, cc: [], bcc: [],
+    # text: carries the plain-text alternative onto the dev path. Every framework
+    # used to drop it, so what you inspected in the mailbox was not what would have
+    # been sent -- a mailbox that shows you a different message is worse than none.
+    def capture(to:, subject:, body:, html: false, text: nil, cc: [], bcc: [],
                 reply_to: nil, from_address: nil, from_name: nil, attachments: [])
       msg_id = SecureRandom.uuid
       timestamp = Time.now
@@ -30,6 +33,7 @@ module Tina4
         reply_to: reply_to,
         subject: subject,
         body: body,
+        text: text,
         html: html,
         attachments: store_attachments(msg_id, attachments),
         read: false,