4runr-os 2.10.74 → 2.10.76

package/mk3-tui/src/app.rs

@@ -5,6 +5,7 @@ use crate::storage::Cache;
 use crate::ui::agent_builder::AgentBuilderState;
 use crate::ui::run_manager::RunManagerState;
 use crate::ui::sentinel_config::SentinelConfigState;
+use crate::ui::shield_dashboard::ShieldDashboardState;
 use crate::ui::settings::SettingsState;
 use crate::websocket::WebSocketClient;
 use crossterm::event::{KeyCode, KeyEvent, KeyEventKind};
@@ -431,6 +432,7 @@ pub struct AppState {
     pub agent_builder: AgentBuilderState,
     pub run_manager: RunManagerState,
     pub sentinel_config: SentinelConfigState,
+    pub shield_dashboard: ShieldDashboardState,
     pub settings: SettingsState,
     pub agent_list: AgentListState,
     pub connection_portal: ConnectionPortalState,
@@ -463,6 +465,7 @@ pub struct AppState {
 
     pub pending_sentinel_load_id: Option<String>,
     pub pending_sentinel_apply_id: Option<String>,
+    pub pending_shield_load_id: Option<String>,
 
     // Deletion confirmation (Step 5.5)
     pub agent_delete_requested: bool,
@@ -530,6 +533,7 @@ impl Default for AppState {
             agent_builder: AgentBuilderState::default(),
             run_manager: RunManagerState::default(),
             sentinel_config: SentinelConfigState::default(),
+            shield_dashboard: ShieldDashboardState::default(),
             settings: SettingsState::default(),
             agent_list: AgentListState::default(),
             connection_portal: ConnectionPortalState::default(),
@@ -554,6 +558,7 @@ impl Default for AppState {
             pending_run_quick_id: None,
             pending_sentinel_load_id: None,
             pending_sentinel_apply_id: None,
+            pending_shield_load_id: None,
             agent_delete_requested: false,
             operation_mode: OperationMode::Local,
             cache: Cache::new().ok(),
@@ -832,6 +837,59 @@ impl App {
         }
     }
 
+    pub fn open_shield_dashboard(&mut self, ws: Option<&WebSocketClient>) {
+        self.push_overlay(Screen::ShieldDashboard);
+        self.state
+            .logs
+            .push_back("[NAV] Opening Shield (production safety layer)...".into());
+        if self.state.operation_mode == OperationMode::Connected {
+            if let Some(ws) = ws {
+                self.begin_shield_load_request(ws, false);
+            }
+        } else {
+            self.state.shield_dashboard.loading = false;
+            self.state.shield_dashboard.error = Some(
+                "Connect to Gateway first (connect portal).".to_string(),
+            );
+        }
+        self.request_immediate_render("open_shield_dashboard");
+    }
+
+    pub fn begin_shield_load_request(&mut self, ws: &WebSocketClient, force: bool) {
+        if self.state.operation_mode != OperationMode::Connected {
+            return;
+        }
+        if !force && self.state.pending_shield_load_id.is_some() {
+            return;
+        }
+        if force {
+            self.state.pending_shield_load_id = None;
+        }
+        self.state.shield_dashboard.mark_loading();
+        self.state.shield_dashboard.error = None;
+        if let Ok(id) = ws.send_command("shield.load", None) {
+            self.state.pending_shield_load_id = Some(id);
+        } else {
+            self.state.shield_dashboard.fail_loading(
+                "Failed to send shield.load to CLI.".to_string(),
+            );
+        }
+    }
+
+    pub fn open_run_from_shield_block(&mut self, ws: Option<&WebSocketClient>, run_id: &str) {
+        self.push_overlay(Screen::RunManager);
+        self.state.run_manager.detail_run_id = Some(run_id.to_string());
+        self.add_log(format!(
+            "[SHIELD] Opening blocked run {} in Run Manager",
+            &run_id[run_id.len().saturating_sub(8)..]
+        ));
+        if let Some(ws) = ws {
+            self.begin_run_list_request(ws, false);
+            self.begin_run_get_request(ws, run_id);
+        }
+        self.request_immediate_render("shield_open_run");
+    }
+
     pub fn open_sentinel_config(&mut self, ws: Option<&WebSocketClient>) {
         self.state.pending_sentinel_load_id = None;
         self.state.pending_sentinel_apply_id = None;
@@ -1320,6 +1378,11 @@ impl App {
             return self.handle_sentinel_config_input(key, ws_client);
         }
 
+        // === SHIELD DASHBOARD INPUT HANDLING ===
+        if self.state.navigation.current_screen() == &Screen::ShieldDashboard {
+            return self.handle_shield_dashboard_input(key, ws_client);
+        }
+
         // === SETTINGS INPUT HANDLING ===
         if self.state.navigation.current_screen() == &Screen::Settings {
             return self.handle_settings_input(key);
@@ -1493,6 +1556,10 @@ impl App {
                                 "  sentinel           - Configure Sentinel policies (templates)"
                                     .to_string(),
                             );
+                            self.state.logs.push_back(
+                                "  shield             - Shield safety dashboard (live metrics + enforcement)"
+                                    .to_string(),
+                            );
                             self.state.logs.push_back(
                                 "  build              - Open Agent Builder (6-step wizard)"
                                     .to_string(),
@@ -1574,55 +1641,8 @@ impl App {
                         "sentinel" | "sentinel config" | "sentinel policies" => {
                             self.open_sentinel_config(ws_client);
                         }
-                        "shield" | "shield status" => {
-                            if self.state.operation_mode == OperationMode::Connected {
-                                if let Some(ws) = ws_client {
-                                    if let Ok(id) = ws.send_command("shield.status", None) {
-                                        self.add_log(format!(
-                                            "[SHIELD] Fetching live status (id: {})",
-                                            &id[id.len().saturating_sub(8)..]
-                                        ));
-                                    }
-                                }
-                            } else {
-                                self.add_log(
-                                    "[SHIELD] Connect to Gateway first.".to_string(),
-                                );
-                            }
-                        }
-                        "shield probe" => {
-                            if self.state.operation_mode == OperationMode::Connected {
-                                if let Some(ws) = ws_client {
-                                    if let Ok(id) = ws.send_command("shield.probe", None) {
-                                        self.add_log(format!(
-                                            "[SHIELD] Probing injection detector (id: {})",
-                                            &id[id.len().saturating_sub(8)..]
-                                        ));
-                                    }
-                                }
-                            } else {
-                                self.add_log(
-                                    "[SHIELD] Connect to Gateway first.".to_string(),
-                                );
-                            }
-                        }
-                        "shield demo" => {
-                            if self.state.operation_mode == OperationMode::Connected {
-                                if let Some(ws) = ws_client {
-                                    if let Ok(id) = ws.send_command("shield.demo", None) {
-                                        self.add_log(format!(
-                                            "[SHIELD] Starting demo run — check Run Manager (id: {})",
-                                            &id[id.len().saturating_sub(8)..]
-                                        ));
-                                    }
-                                    self.push_overlay(Screen::RunManager);
-                                    self.begin_run_list_request(ws, false);
-                                }
-                            } else {
-                                self.add_log(
-                                    "[SHIELD] Connect to Gateway first.".to_string(),
-                                );
-                            }
+                        "shield" | "shield status" | "shield dashboard" => {
+                            self.open_shield_dashboard(ws_client);
                         }
                         "config" | "settings" => {
                             self.push_overlay(Screen::Settings);
@@ -1908,6 +1928,10 @@ impl App {
                 use crate::ui::sentinel_config;
                 sentinel_config::render(f, &self.state);
             }
+            Screen::ShieldDashboard => {
+                use crate::ui::shield_dashboard;
+                shield_dashboard::render(f, &self.state);
+            }
             Screen::Settings => {
                 use crate::ui::settings;
                 settings::render(f, &self.state);
@@ -2642,6 +2666,121 @@ impl App {
         Ok(false)
     }
 
+    fn handle_shield_dashboard_input(
+        &mut self,
+        key: KeyEvent,
+        ws_client: Option<&WebSocketClient>,
+    ) -> anyhow::Result<bool> {
+        use crate::ui::shield_dashboard::ShieldTab;
+        use crossterm::event::KeyModifiers;
+
+        if key.modifiers.contains(KeyModifiers::CONTROL) {
+            match key.code {
+                KeyCode::Char('c') | KeyCode::Char('q') => return Ok(true),
+                _ => return Ok(false),
+            }
+        }
+
+        match key.code {
+            KeyCode::Tab => {
+                self.state.shield_dashboard.tab = self.state.shield_dashboard.tab.next();
+                self.request_render("shield_tab");
+            }
+            KeyCode::BackTab => {
+                self.state.shield_dashboard.tab = self.state.shield_dashboard.tab.prev();
+                self.request_render("shield_tab_back");
+            }
+            KeyCode::Left => {
+                self.state.shield_dashboard.tab = self.state.shield_dashboard.tab.prev();
+                self.request_render("shield_tab_left");
+            }
+            KeyCode::Right => {
+                self.state.shield_dashboard.tab = self.state.shield_dashboard.tab.next();
+                self.request_render("shield_tab_right");
+            }
+            KeyCode::Up => {
+                if self.state.shield_dashboard.tab == ShieldTab::Enforcement
+                    && self.state.shield_dashboard.selected_block_index > 0
+                {
+                    self.state.shield_dashboard.selected_block_index -= 1;
+                    self.request_render("shield_block_up");
+                }
+            }
+            KeyCode::Down => {
+                if self.state.shield_dashboard.tab == ShieldTab::Enforcement {
+                    let max = self.state.shield_dashboard.recent_blocks.len();
+                    if max > 0 && self.state.shield_dashboard.selected_block_index + 1 < max {
+                        self.state.shield_dashboard.selected_block_index += 1;
+                        self.request_render("shield_block_down");
+                    }
+                }
+            }
+            KeyCode::Enter => {
+                if self.state.shield_dashboard.tab == ShieldTab::Enforcement {
+                    if let Some(row) = self
+                        .state
+                        .shield_dashboard
+                        .recent_blocks
+                        .get(self.state.shield_dashboard.selected_block_index)
+                    {
+                        let run_id = row.id.clone();
+                        self.open_run_from_shield_block(ws_client, &run_id);
+                    }
+                }
+            }
+            KeyCode::Char('r') | KeyCode::Char('R') => {
+                if self.state.operation_mode == OperationMode::Connected {
+                    if let Some(ws) = ws_client {
+                        self.begin_shield_load_request(ws, true);
+                    }
+                } else {
+                    self.state.shield_dashboard.fail_loading(
+                        "Connect to Gateway first (connect portal).".to_string(),
+                    );
+                }
+                self.request_render("shield_refresh");
+            }
+            KeyCode::Char('o') | KeyCode::Char('O') => {
+                self.push_overlay(Screen::RunManager);
+                if let Some(ws) = ws_client {
+                    self.begin_run_list_request(ws, false);
+                }
+                self.add_log("[SHIELD] Opened Run Manager".to_string());
+                self.request_render("shield_open_runs");
+            }
+            KeyCode::Char('p') | KeyCode::Char('P') => {
+                if self.state.operation_mode == OperationMode::Connected {
+                    self.state.navigation.navigate_to_base(Screen::PortalMonitoring);
+                    if let Some(ws) = ws_client {
+                        self.begin_portal_observability_request(ws);
+                    }
+                    self.add_log("[SHIELD] Opened Portal Monitoring".to_string());
+                } else {
+                    self.add_log("[SHIELD] Connect to Gateway first.".to_string());
+                }
+                self.request_render("shield_open_monitoring");
+            }
+            KeyCode::Char('a') | KeyCode::Char('A') => {
+                self.state.shield_dashboard.auto_refresh_enabled =
+                    !self.state.shield_dashboard.auto_refresh_enabled;
+                let status = if self.state.shield_dashboard.auto_refresh_enabled {
+                    "ON"
+                } else {
+                    "OFF"
+                };
+                self.add_log(format!("[SHIELD] Live refresh {}", status));
+                self.request_render("shield_live_toggle");
+            }
+            KeyCode::Esc => {
+                self.pop_overlay();
+                self.request_render("shield_close");
+            }
+            _ => {}
+        }
+
+        Ok(false)
+    }
+
     // ============================================================
     // SETTINGS INPUT HANDLING (Step 4.8)
     // ============================================================

package/mk3-tui/src/main.rs

@@ -189,6 +189,44 @@ fn main() -> Result<()> {
             }
         }
 
+        // Shield dashboard: live poll shield.load every ~5s when enabled
+        if matches!(current_screen, Screen::ShieldDashboard)
+            && app.state.operation_mode == OperationMode::Connected
+        {
+            let shield_poll = {
+                let sd = &app.state.shield_dashboard;
+                if !sd.auto_refresh_enabled || sd.loading {
+                    false
+                } else {
+                    sd.last_refresh
+                        .map(|lr| lr.elapsed() >= sd.auto_refresh_interval)
+                        .unwrap_or(true)
+                }
+            };
+            if shield_poll {
+                if let Some(ws) = &ws_client {
+                    app.begin_shield_load_request(ws, false);
+                }
+            }
+
+            // Loading timeout — never spin forever if CLI deduped or dropped a response
+            let loading_stuck = {
+                let sd = &app.state.shield_dashboard;
+                sd.loading
+                    && sd
+                        .loading_started
+                        .map(|t| t.elapsed() >= std::time::Duration::from_secs(12))
+                        .unwrap_or(false)
+            };
+            if loading_stuck {
+                app.state.shield_dashboard.fail_loading(
+                    "Shield load timed out — press R to refresh.".to_string(),
+                );
+                app.state.pending_shield_load_id = None;
+                app.request_render("shield_load_timeout");
+            }
+        }
+
         // Run Manager: live poll run.list every ~3s when enabled (no manual R)
         if matches!(current_screen, Screen::RunManager)
             && app.state.operation_mode == OperationMode::Connected
@@ -669,6 +707,66 @@ fn main() -> Result<()> {
                                         }
                                         app.request_render("run_quick_ok");
                                     }
+                                    // Shield dashboard: load health + config + metrics + history
+                                    else if Some(&resp.id)
+                                        == app.state.pending_shield_load_id.as_ref()
+                                    {
+                                        app.state.pending_shield_load_id = None;
+                                        if obj.get("shieldLoad").and_then(|v| v.as_bool()) == Some(true)
+                                        {
+                                            use crate::ui::shield_dashboard::parse_shield_load;
+                                            let health_val = obj
+                                                .get("health")
+                                                .cloned()
+                                                .unwrap_or(serde_json::Value::Null);
+                                            let config_val = obj
+                                                .get("config")
+                                                .cloned()
+                                                .unwrap_or(serde_json::Value::Null);
+                                            let metrics_val = obj
+                                                .get("metrics")
+                                                .cloned()
+                                                .unwrap_or(serde_json::Value::Null);
+                                            let gateway_health_val = obj
+                                                .get("gatewayHealth")
+                                                .cloned()
+                                                .unwrap_or(serde_json::Value::Null);
+                                            let runs_val = obj
+                                                .get("recentRuns")
+                                                .cloned()
+                                                .unwrap_or(serde_json::Value::Null);
+                                            let warnings_vec: Vec<String> = obj
+                                                .get("warnings")
+                                                .and_then(|v| v.as_array())
+                                                .map(|a| {
+                                                    a.iter()
+                                                        .filter_map(|w| {
+                                                            w.as_str().map(|s| s.to_string())
+                                                        })
+                                                        .collect()
+                                                })
+                                                .unwrap_or_default();
+                                            let (h, c, m, mut w, recent) = parse_shield_load(
+                                                &health_val,
+                                                &config_val,
+                                                &metrics_val,
+                                                &gateway_health_val,
+                                                &runs_val,
+                                            );
+                                            w.extend(warnings_vec);
+                                            app.state.shield_dashboard.apply_load(
+                                                &h, &c, &m, w, recent,
+                                            );
+                                            app.state.shield_mode = h.mode.clone();
+                                            app.state.shield_blocks_total = m.blocks;
+                                            app.state.shield_masks_total = m.masks;
+                                            app.add_log(format!(
+                                                "✓ [{}] Shield loaded — {} block(s), {} mask(s)",
+                                                short_id, m.blocks, m.masks
+                                            ));
+                                        }
+                                        app.request_render("shield_loaded");
+                                    }
                                     // Sentinel config: load templates + current + health
                                     else if Some(&resp.id)
                                         == app.state.pending_sentinel_load_id.as_ref()
@@ -1542,6 +1640,15 @@ fn main() -> Result<()> {
                                     "✗ [{}] run.quick failed: {}",
                                     short_id, error_msg
                                 ));
+                            } else if Some(&resp.id) == app.state.pending_shield_load_id.as_ref() {
+                                app.state.pending_shield_load_id = None;
+                                app.state
+                                    .shield_dashboard
+                                    .fail_loading(error_msg.clone());
+                                app.add_log(format!(
+                                    "✗ [{}] shield.load failed: {}",
+                                    short_id, error_msg
+                                ));
                             } else if Some(&resp.id) == app.state.pending_sentinel_load_id.as_ref()
                             {
                                 app.state.pending_sentinel_load_id = None;

package/mk3-tui/src/screens/mod.rs

@@ -18,6 +18,7 @@ pub enum Screen {
     AgentBuilder,
     RunManager,
     SentinelConfig,
+    ShieldDashboard,
     Settings,
     AgentList,
     ConnectionPortal,
@@ -40,7 +41,7 @@ impl Screen {
     pub fn is_overlay(&self) -> bool {
         matches!(
             self,
-            Screen::AgentBuilder | Screen::RunManager | Screen::SentinelConfig | Screen::Settings | Screen::AgentList
+            Screen::AgentBuilder | Screen::RunManager | Screen::SentinelConfig | Screen::ShieldDashboard | Screen::Settings | Screen::AgentList
         )
     }
 
@@ -70,6 +71,7 @@ impl Screen {
             Screen::AgentBuilder => "Agent Builder",
             Screen::RunManager => "Run Manager",
             Screen::SentinelConfig => "Sentinel Config",
+            Screen::ShieldDashboard => "Shield",
             Screen::Settings => "Settings",
             Screen::AgentList => "Agent List",
             Screen::ConnectionPortal => "Connection Portal",

package/mk3-tui/src/ui/mod.rs

@@ -8,5 +8,6 @@ pub mod portal_monitoring;
 pub mod run_manager;
 pub mod safe_viewport;
 pub mod sentinel_config;
+pub mod shield_dashboard;
 pub mod settings;
 pub mod setup_portal;