4runr-os 2.10.64 → 2.10.65

package/apps/gateway/src/__tests__/sentinel-config-persist-http.test.ts

@@ -11,6 +11,7 @@ import { Sentinel } from '@4runr/sentinel';
 import {
   getSentinelLimitsFilePath,
   applyPersistedSentinelConfig,
+  hydrateSentinelConfigFromDisk,
 } from '../security/sentinel-config-store.js';
 
 jest.mock('../middleware/rateLimit.js', () => ({
@@ -81,5 +82,12 @@ describe('POST /api/sentinel/policies/custom persistence', () => {
     const sentinel = Sentinel.getInstance();
     expect(applyPersistedSentinelConfig(sentinel)).toBe(true);
     expect(sentinel.getConfig().runIdleMs).toBe(distinctiveIdle);
+
+    Sentinel.resetInstance();
+    const stale = Sentinel.getInstance();
+    expect(stale.getConfig().runIdleMs).not.toBe(distinctiveIdle);
+
+    hydrateSentinelConfigFromDisk(stale);
+    expect(stale.getConfig().runIdleMs).toBe(distinctiveIdle);
   });
 });

package/apps/gateway/src/routes/sentinel-policies.ts

@@ -12,7 +12,11 @@ import {
 } from '@4runr/sentinel';
 import { requireAuth } from '../middleware/auth.js';
 import { readRateLimit, writeRateLimit } from '../middleware/rateLimit.js';
-import { persistSentinelConfigAfterApply } from '../security/sentinel-config-store.js';
+import {
+  persistSentinelConfigAfterApply,
+  hydrateSentinelConfigFromDisk,
+  getSentinelLimitsFilePath,
+} from '../security/sentinel-config-store.js';
 
 /**
  * Register Sentinel policy management routes
@@ -235,7 +239,7 @@ export async function sentinelPolicyRoutes(fastify: FastifyInstance) {
           return {
             success: true,
             config,
-            message: `Custom Sentinel limits applied and saved to ${savedTo}. Survives Gateway restart; env vars override individual fields when set.`,
+            message: `Custom limits saved (${savedTo}). Reopen Sentinel or restart Gateway to reload; env vars override fields when set.`,
           };
         } catch (error: unknown) {
           const msg = error instanceof Error ? error.message : String(error);
@@ -270,10 +274,12 @@ export async function sentinelPolicyRoutes(fastify: FastifyInstance) {
     try {
       const { Sentinel } = await import('@4runr/sentinel');
       const sentinel = Sentinel.getInstance();
-      
+      hydrateSentinelConfigFromDisk(sentinel);
+
       return {
         success: true,
-        config: sentinel.getConfig()
+        config: sentinel.getConfig(),
+        persistedPath: getSentinelLimitsFilePath(),
       };
     } catch (error: any) {
       return reply.status(500).send({

package/apps/gateway/src/security/sentinel-config-store.ts

@@ -109,13 +109,8 @@ export function saveSentinelLimitsToDisk(config: SentinelConfig): void {
   fs.writeFileSync(filePath, JSON.stringify(payload, null, 2), { mode: 0o600 });
 }
 
-/**
- * Apply saved limits on Gateway boot. Env-defined fields keep env values.
- */
-export function applyPersistedSentinelConfig(sentinel: Sentinel, logger?: {
-  info: (msg: string, meta?: Record<string, unknown>) => void;
-  warn: (msg: string, meta?: Record<string, unknown>) => void;
-}): boolean {
+/** Merge saved limits from disk into the live Sentinel singleton (env wins per field). */
+export function mergePersistedSentinelConfig(sentinel: Sentinel): boolean {
   const saved = loadSentinelLimitsFromDisk();
   if (!saved) return false;
 
@@ -129,16 +124,31 @@ export function applyPersistedSentinelConfig(sentinel: Sentinel, logger?: {
 
   try {
     sentinel.updateConfig(merged);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Apply saved limits on Gateway boot. Env-defined fields keep env values.
+ */
+export function applyPersistedSentinelConfig(sentinel: Sentinel, logger?: {
+  info: (msg: string, meta?: Record<string, unknown>) => void;
+  warn: (msg: string, meta?: Record<string, unknown>) => void;
+}): boolean {
+  const ok = mergePersistedSentinelConfig(sentinel);
+  if (ok) {
     logger?.info('Sentinel limits loaded from disk', {
       path: getSentinelLimitsFilePath(),
     });
-    return true;
-  } catch (err) {
-    logger?.warn('Failed to apply saved Sentinel limits', {
-      error: err instanceof Error ? err.message : String(err),
-    });
-    return false;
   }
+  return ok;
+}
+
+/** Call before returning policy config to clients so long-lived Gateway picks up disk saves. */
+export function hydrateSentinelConfigFromDisk(sentinel: Sentinel): void {
+  mergePersistedSentinelConfig(sentinel);
 }
 
 export function persistSentinelConfigAfterApply(

package/mk3-tui/src/app.rs

@@ -828,13 +828,30 @@ impl App {
         }
     }
 
+    pub fn open_sentinel_config(&mut self, ws: Option<&WebSocketClient>) {
+        self.state.pending_sentinel_load_id = None;
+        self.state.pending_sentinel_apply_id = None;
+        self.push_overlay(Screen::SentinelConfig);
+        self.state
+            .logs
+            .push_back("[NAV] Opening Sentinel Configuration...".into());
+        if self.state.operation_mode == OperationMode::Connected {
+            if let Some(ws) = ws {
+                self.begin_sentinel_load_request(ws);
+            }
+        } else {
+            self.state.sentinel_config.error = Some(
+                "Connect to Gateway first (connect portal).".to_string(),
+            );
+        }
+        self.request_immediate_render("open_sentinel_config");
+    }
+
     pub fn begin_sentinel_load_request(&mut self, ws: &WebSocketClient) {
         if self.state.operation_mode != OperationMode::Connected {
             return;
         }
-        if self.state.pending_sentinel_load_id.is_some()
-            || self.state.pending_sentinel_apply_id.is_some()
-        {
+        if self.state.pending_sentinel_load_id.is_some() {
             return;
         }
         self.state.sentinel_config.loading = true;
@@ -1551,19 +1568,7 @@ impl App {
                             }
                         }
                         "sentinel" | "sentinel config" | "sentinel policies" => {
-                            self.push_overlay(Screen::SentinelConfig);
-                            self.state
-                                .logs
-                                .push_back("[NAV] Opening Sentinel Configuration...".into());
-                            if self.state.operation_mode == OperationMode::Connected {
-                                if let Some(ws) = ws_client {
-                                    self.begin_sentinel_load_request(ws);
-                                }
-                            } else {
-                                self.state.sentinel_config.error = Some(
-                                    "Connect to Gateway first (connect portal).".to_string(),
-                                );
-                            }
+                            self.open_sentinel_config(ws_client);
                         }
                         "config" | "settings" => {
                             self.push_overlay(Screen::Settings);
@@ -2514,7 +2519,7 @@ impl App {
 
         match key.code {
             KeyCode::Tab => {
-                self.state.sentinel_config.toggle_view_mode();
+                self.state.sentinel_config.cycle_view_mode();
                 self.request_immediate_render("sentinel_tab");
             }
             KeyCode::Up => {
@@ -2567,6 +2572,10 @@ impl App {
                         Some("Connect to Gateway first.".to_string());
                 } else if let Some(ws) = ws_client {
                     match self.state.sentinel_config.view_mode {
+                        SentinelViewMode::About => {
+                            self.begin_sentinel_load_request(ws);
+                            self.request_render("sentinel_about_refresh");
+                        }
                         SentinelViewMode::Templates => {
                             if let Some(t) = self.state.sentinel_config.selected_template() {
                                 let key = t.key.clone();

package/mk3-tui/src/ui/sentinel_config.rs

@@ -14,10 +14,29 @@ const BG_PANEL: Color = Color::Rgb(18, 18, 25);
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum SentinelViewMode {
+    About,
     Templates,
     Custom,
 }
 
+const ABOUT_SENTINEL_LINES: &[&str] = &[
+    "Sentinel is 4Runr's runtime safety layer for agent executions on this Gateway.",
+    "",
+    "What it does:",
+    "  • Watches each run while it is running (queue processor path)",
+    "  • Enforces limits: idle time, max duration, token cap, cost, loop detection",
+    "  • On violation: kills the run (status killed, policy_violation:* in logs)",
+    "",
+    "Scope today:",
+    "  • One policy for ALL runs on this Gateway (not per-agent yet)",
+    "  • A run = one agent execution (POST /api/runs → start → agent runs)",
+    "",
+    "How to use this screen:",
+    "  • Templates: apply a preset · Custom: tune fields · Enter: save to disk",
+    "  • Saved file survives Gateway restart (see path in Custom help)",
+    "  • Env vars in docker-compose override individual fields when set",
+];
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum CustomField {
     Enabled,
@@ -165,13 +184,14 @@ impl SentinelConfigState {
         self.templates.get(self.selected_index)
     }
 
-    pub fn toggle_view_mode(&mut self) {
+    pub fn cycle_view_mode(&mut self) {
         self.view_mode = match self.view_mode {
+            SentinelViewMode::About => SentinelViewMode::Templates,
             SentinelViewMode::Templates => {
                 self.sync_custom_draft_from_current();
                 SentinelViewMode::Custom
             }
-            SentinelViewMode::Custom => SentinelViewMode::Templates,
+            SentinelViewMode::Custom => SentinelViewMode::About,
         };
         self.error = None;
         self.status_message = None;
@@ -191,6 +211,7 @@ impl SentinelConfigState {
 
     pub fn select_previous(&mut self) {
         match self.view_mode {
+            SentinelViewMode::About => {}
             SentinelViewMode::Templates => {
                 if self.selected_index > 0 {
                     self.selected_index -= 1;
@@ -210,6 +231,7 @@ impl SentinelConfigState {
 
     pub fn select_next(&mut self) {
         match self.view_mode {
+            SentinelViewMode::About => {}
             SentinelViewMode::Templates => {
                 if self.selected_index + 1 < self.templates.len() {
                     self.selected_index += 1;
@@ -489,6 +511,7 @@ pub fn render(f: &mut Frame, state: &AppState) {
         .split(area);
 
     let mode_label = match sc.view_mode {
+        SentinelViewMode::About => "About",
         SentinelViewMode::Templates => "Templates",
         SentinelViewMode::Custom => "Custom",
     };
@@ -514,6 +537,9 @@ pub fn render(f: &mut Frame, state: &AppState) {
         .split(chunks[1]);
 
     match sc.view_mode {
+        SentinelViewMode::About => {
+            render_about_panel(f, chunks[1], sc);
+        }
         SentinelViewMode::Templates => {
             render_active_panel(f, body[0], sc);
             render_templates_panel(f, body[1], sc);
@@ -525,11 +551,14 @@ pub fn render(f: &mut Frame, state: &AppState) {
     }
 
     let default_footer = match sc.view_mode {
+        SentinelViewMode::About => {
+            "Tab: Templates · R: reload from Gateway · ESC: Close"
+        }
         SentinelViewMode::Templates => {
-            "Tab Custom · ↑/↓ Template · Enter Apply · R Refresh · ESC Close"
+            "Tab: next view · ↑/↓ Template · Enter Apply · R Refresh · ESC Close"
         }
         SentinelViewMode::Custom => {
-            "Tab Templates · ↑/↓ Field · ←/→ Value · Enter Apply (saves to disk) · ESC Close"
+            "Tab: next view · ↑/↓ Field · ←/→ Value · Enter Apply (saves to disk) · ESC Close"
         }
     };
     const CUSTOM_SHORTCUTS: &str =
@@ -573,6 +602,48 @@ pub fn render(f: &mut Frame, state: &AppState) {
     );
 }
 
+fn render_about_panel(f: &mut Frame, area: Rect, sc: &SentinelConfigState) {
+    let block = Block::default()
+        .title(" 📖  What is Sentinel? ")
+        .borders(Borders::ALL)
+        .border_style(Style::default().fg(CYBER_CYAN))
+        .style(Style::default().bg(BG_PANEL));
+    let inner = block.inner(area);
+    f.render_widget(block, area);
+
+    let mut lines: Vec<Line> = Vec::new();
+    for line in ABOUT_SENTINEL_LINES {
+        if line.is_empty() {
+            lines.push(Line::from(""));
+            continue;
+        }
+        let style = if line.starts_with("  •") {
+            Style::default().fg(TEXT_PRIMARY)
+        } else if line.ends_with(':') && !line.starts_with(' ') {
+            Style::default().fg(NEON_GREEN).bold()
+        } else {
+            Style::default().fg(TEXT_DIM)
+        };
+        lines.push(Line::from(Span::styled(*line, style)));
+    }
+    lines.push(Line::from(""));
+    lines.push(Line::from(vec![
+        Span::styled("Active limits now: ", Style::default().fg(TEXT_DIM)),
+        Span::styled(
+            if sc.current_enabled { "ON" } else { "OFF" },
+            Style::default().fg(NEON_GREEN),
+        ),
+        Span::styled(" · idle ", Style::default().fg(TEXT_DIM)),
+        Span::styled(fmt_ms(sc.current_idle_ms), Style::default().fg(TEXT_PRIMARY)),
+        Span::styled(" · max ", Style::default().fg(TEXT_DIM)),
+        Span::styled(fmt_ms(sc.current_duration_ms), Style::default().fg(TEXT_PRIMARY)),
+        Span::styled(" · cost ", Style::default().fg(TEXT_DIM)),
+        Span::styled(fmt_cost(sc.current_max_cost), Style::default().fg(AMBER_WARN)),
+    ]));
+
+    f.render_widget(Paragraph::new(lines).wrap(Wrap { trim: false }), inner);
+}
+
 fn render_active_panel(f: &mut Frame, area: Rect, sc: &SentinelConfigState) {
     let block = Block::default()
         .title(" ⚙️  Active limits (live) ")
@@ -627,7 +698,7 @@ fn render_active_panel(f: &mut Frame, area: Rect, sc: &SentinelConfigState) {
             ),
         ]),
         Line::from(""),
-        Line::from("Press Tab → Custom to tune your own limits.").style(Style::default().fg(TEXT_MUTED)),
+        Line::from("Tab → About / Custom / Templates to switch views.").style(Style::default().fg(TEXT_MUTED)),
     ];
     f.render_widget(Paragraph::new(lines).wrap(Wrap { trim: false }), inner);
 }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "4runr-os",
-  "version": "2.10.64",
+  "version": "2.10.65",
   "type": "module",
-  "description": "4Runr AI Agent OS - Secure terminal interface for AI agents. v2.10.64: Sentinel limits persist to disk; Custom tab edit with arrow keys and M:SS display.",
+  "description": "4Runr AI Agent OS - Secure terminal interface for AI agents. v2.10.65: Sentinel limits reload from disk on open; About tab explains purpose.",
   "main": "dist/index.js",
   "bin": {
     "4runr": "dist/index.js",