@chemx/starter-kit 26.10.8-344 → 26.10.10-75

package/cli/ui-index.html

@@ -795,7 +795,7 @@ const App = {
               <div class="xo-kpi__value" style="color:var(--xo-cyan);">{{ codebase.length }}</div>
             </div>
             <div class="xo-kpi">
-              <div class="xo-kpi__label">Under 100L</div>
+              <div class="xo-kpi__label">Within line budget</div>
               <div class="xo-kpi__value" style="color:var(--xo-lime);">{{ compliantCount }}</div>
             </div>
             <div class="xo-kpi">
@@ -817,7 +817,7 @@ const App = {
             <div v-for="f in filteredCodebase" :key="f.path" class="xo-file-card">
               <div class="d-flex align-center gap-2 mb-1">
                 <v-chip v-if="f.tier" size="x-small" :class="'tier-'+f.tier">{{ f.tier }}</v-chip>
-                <v-chip v-if="f.lines>100" size="x-small" class="xo-hazard">{{ f.lines }}L ⚠</v-chip>
+                <v-chip v-if="f.isOverBudget" size="x-small" class="xo-hazard">{{ f.lines }}L ⚠</v-chip>
                 <v-chip v-else-if="f.lines" size="x-small" variant="outlined" style="border-color:rgba(255,255,255,.12);color:rgba(255,255,255,.4);">{{ f.lines }}L</v-chip>
                 <v-chip v-if="f.coverage!=null" size="x-small" color="success" variant="tonal">{{ f.coverage }}%</v-chip>
               </div>
@@ -1009,7 +1009,7 @@ const App = {
       });
     };
 
-    const compliantCount  = computed(() => codebase.value.filter(f => !f.lines || f.lines <= 100).length);
+    const compliantCount  = computed(() => codebase.value.filter(f => !f.isOverBudget).length);
     const compliancePct   = computed(() => !codebase.value.length ? 0 : Math.round(compliantCount.value / codebase.value.length * 100));
 
     const filteredCodebase = computed(() => {

package/cli/ui-route-helpers.js

@@ -0,0 +1,10 @@
+export const sendJson = (res, status, payload, extraHeaders = {}, afterSend = null) => {
+  res.writeHead(status, { 'Content-Type': 'application/json', ...extraHeaders });
+  res.end(JSON.stringify(payload));
+  if (afterSend) afterSend();
+  return res;
+};
+
+export const runRoute = (handler) => {
+  try { return [handler(), null]; } catch (err) { return [null, err]; }
+};

package/cli/ui-server-routes.js

@@ -17,27 +17,29 @@ import {
 } from './ui-actions.js';
 import { getDatabaseMetrics, executeSqlQuery } from './ui-db-studio.js';
 import { scanAttentionItems, confirmAttentionItem } from './ui-attention.js';
+import { withFreshIndex } from './ui-fresh-index.js';
 
-export const routeGet = (pathname, db, cwd = process.cwd(), queryParams = {}) => {
+// db: team rows (coordination db, #2581); indexDb (default db): code index for codebase, metrics, db studio.
+export const routeGet = (pathname, db, cwd = process.cwd(), queryParams = {}, { indexDb = db } = {}) => {
   const [cleanPath, search] = (pathname || '').split('?');
   const parsedParams = search ? Object.fromEntries(new URLSearchParams(search)) : queryParams;
   const normPath = cleanPath.replace(/^\/api\/swarm\//, '/api/');
 
   const routes = {
-    '/api/status': () => handleSwarmStatus(db, cwd),
+    '/api/status': () => handleSwarmStatus(db, cwd, indexDb),
     '/api/feed': () => ({ success: true, feed: queryFeed(db, parsedParams) }),
     '/api/tasks': () => ({ success: true, tasks: listTasks(db, parsedParams) }),
     '/api/categories': () => ({ success: true, categories: getForumCategories(db) }),
-    '/api/agents': () => ({ success: true, agents: handleSwarmStatus(db, cwd).agents }),
-    '/api/codebase': () => handleCodebaseIndex(db),
-    '/api/codebase/tree': () => handleCodebaseTree(db),
-    '/api/codebase/file': () => handleCodebaseFile(db, parsedParams.path, cwd),
-    '/api/database/metrics': () => getDatabaseMetrics(db, cwd),
+    '/api/agents': () => ({ success: true, agents: handleSwarmStatus(db, cwd, indexDb).agents }),
+    '/api/codebase': () => withFreshIndex(cwd, {}, () => handleCodebaseIndex(indexDb, cwd)),
+    '/api/codebase/tree': () => withFreshIndex(cwd, {}, () => handleCodebaseTree(indexDb, cwd)),
+    '/api/codebase/file': () => withFreshIndex(cwd, { paths: [parsedParams.path], scope: false }, () => handleCodebaseFile(indexDb, parsedParams.path, cwd)),
+    '/api/database/metrics': () => getDatabaseMetrics(indexDb, cwd),
     '/api/topics': () => handleGetTopics(db, parsedParams.category),
     '/api/topics/posts': () => handleGetTopicPosts(db, parsedParams.topicId || parsedParams.topic_id),
     '/api/attention': () => scanAttentionItems(db, cwd),
-    '/api/db/tables': () => handleDbTables(db, cwd),
-    '/api/db/browse': () => handleDbBrowse(db, parsedParams), '/api/db/structure': () => handleDbStructure(db, parsedParams)
+    '/api/db/tables': () => handleDbTables(indexDb, cwd),
+    '/api/db/browse': () => handleDbBrowse(indexDb, parsedParams), '/api/db/structure': () => handleDbStructure(indexDb, parsedParams)
   };
 
   const hasRoute = Object.prototype.hasOwnProperty.call(routes, normPath);
@@ -53,7 +55,7 @@ export const routeGet = (pathname, db, cwd = process.cwd(), queryParams = {}) =>
   return null;
 };
 
-export const routePost = (pathname, db, body, cwd = process.cwd()) => {
+export const routePost = (pathname, db, body, cwd = process.cwd(), { consoleDb = null } = {}) => {
   const [cleanPath] = (pathname || '').split('?');
   const postFeedHandler = handleCreateFeedPost || handlePostFeed;
   const normPath = cleanPath.replace(/^\/api\/swarm\//, '/api/');
@@ -72,10 +74,10 @@ export const routePost = (pathname, db, body, cwd = process.cwd()) => {
     '/api/agents/signature': () => handleUpdateSignature(db, body),
     '/api/topics': () => handleCreateTopic(db, body),
     '/api/settings/action': () => handleSettingsAction(db, body),
-    '/api/database/query': () => executeSqlQuery(db, body.query),
+    '/api/database/query': () => executeSqlQuery(consoleDb, body.query),
     '/api/attention/action': () => confirmAttentionItem(db, body.itemId, body.action),
     '/api/prompts/generate': () => handleGeneratePrompt(db, body, cwd),
-    '/api/db/query': () => handleDbQuery(db, body)
+    '/api/db/query': () => handleDbQuery(consoleDb, body)
   };
 
   const hasRoute = Object.prototype.hasOwnProperty.call(routes, normPath);
@@ -88,11 +90,7 @@ export const parseJsonBody = (req) => {
     let raw = '';
     req.on('data', (chunk) => { raw += chunk; });
     req.on('end', () => {
-      try {
-        resolve(JSON.parse(raw || '{}'));
-      } catch (err) {
-        reject(err);
-      }
+      Promise.resolve(raw || '{}').then(JSON.parse).then(resolve, reject);
     });
     req.on('error', reject);
   });

package/cli/ui-server.js

@@ -1,77 +1,74 @@
 import http from 'node:http';
 import { openIndexDb } from './search-db.js';
+import { openTeamContext, describeTeamDbFailure } from './team/coordination-db.js';
 import { handleSwarmStatus } from './ui-handlers.js';
 import { generateSwarmHtml } from './ui-html.js';
 import { routeGet, routePost, parseJsonBody } from './ui-server-routes.js';
 import { handleSseConnection, broadcastSseUpdate, broadcastSseReload, closeSseHub } from './ui-sse.js';
+import { createUiAuth, checkUiRequest, createUiFetch, isLoopbackHost, resolveUiUrlHost, DEFAULT_UI_HOST } from './ui-auth.js';
+import { openConsoleDb } from './ui-sql-guard.js';
+import { sendJson, runRoute } from './ui-route-helpers.js';
 
-export const createUiServer = (cwd = process.cwd()) => {
-  const db = openIndexDb(cwd);
+export const createUiServer = (cwd = process.cwd(), options = {}) => {
+  const indexDb = openIndexDb(cwd);
+  const teamContext = openTeamContext(cwd);
+  const db = teamContext.db; // team rows: coordination db only (#2581), null when refused; code index, studio, console: indexDb
+  const auth = options.auth || createUiAuth();
+  const consoleDb = openConsoleDb(cwd);
   const server = http.createServer(async (req, res) => {
-    const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+    const url = new URL(req.url || '/', 'http://chemx-ui.invalid');
     const { pathname } = url;
     const isGet = req.method === 'GET', isPost = req.method === 'POST';
-    const isApi = pathname.startsWith('/api/'), isFavicon = pathname === '/favicon.ico';
-    const shouldServeHtml = isGet && !isApi && !isFavicon;
-    const shouldServeFavicon = isGet && isFavicon;
-
+    const isApi = pathname.startsWith('/api/'), isFaviconRequest = isGet && pathname === '/favicon.ico';
+    if (isFaviconRequest) return res.writeHead(204).end();
+    const gate = checkUiRequest(req, auth, url);
+    const isDenied = !gate.allowed;
+    if (isDenied) return sendJson(res, gate.status, { success: false, error: gate.error });
+    const hasSetCookie = Boolean(gate.setCookie);
+    const cookieHeaders = hasSetCookie ? { 'Set-Cookie': gate.setCookie } : {};
+    const isTeamUnavailable = !db;
+    if (isTeamUnavailable) return sendJson(res, 503, { success: false, error: describeTeamDbFailure(teamContext) }, cookieHeaders);
+    const shouldServeHtml = isGet && !isApi;
     if (shouldServeHtml) {
-      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-      res.end(generateSwarmHtml(handleSwarmStatus(db)));
-      return;
+      return res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', ...cookieHeaders }).end(generateSwarmHtml(handleSwarmStatus(db, cwd, indexDb)));
     }
-    if (shouldServeFavicon) { res.writeHead(204); res.end(); return; }
-
     if (isGet) {
       const isSse = pathname === '/api/swarm/events' || pathname === '/api/events';
-      if (isSse) {
-        handleSseConnection(req, res, db);
-        return;
-      }
-      const result = routeGet(req.url, db, cwd);
-      if (result) {
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify(result));
-        return;
-      }
+      if (isSse) return handleSseConnection(req, res, db);
+      const [result, getError] = runRoute(() => routeGet(req.url, db, cwd, {}, { indexDb }));
+      if (getError) return sendJson(res, 500, { success: false, error: getError.message }, cookieHeaders);
+      if (result) return sendJson(res, 200, result, cookieHeaders);
     }
-
     if (isPost) {
-      try {
-        const body = await parseJsonBody(req);
-        const result = routePost(req.url, db, body, cwd);
-        if (result) {
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify(result));
-          broadcastSseUpdate(db);
-          return;
-        }
-      } catch (err) {
-        res.writeHead(400, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'Invalid JSON payload' }));
-        return;
-      }
+      const [body, parseError] = await parseJsonBody(req).then((value) => [value, null], (err) => [null, err]);
+      if (parseError) return sendJson(res, 400, { error: 'Invalid JSON payload' });
+      const [result, routeError] = runRoute(() => routePost(req.url, db, body, cwd, { consoleDb }));
+      if (routeError) return sendJson(res, 500, { success: false, error: routeError.message });
+      if (result) return sendJson(res, 200, result, {}, () => broadcastSseUpdate(db));
     }
-    res.writeHead(404, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ error: 'Not found' }));
+    return sendJson(res, 404, { error: 'Not found' });
   });
 
-  server.on('close', closeSseHub);
-  return { server, db };
+  server.on('close', () => { closeSseHub(); consoleDb?.close(); });
+  return { server, db, indexDb, auth };
 };
 
+const warnPublicBind = (host) => process.stderr.write(
+  `\x1b[33m⚠ chemx ui is bound to ${host}, reachable beyond this machine. Anyone with the token URL can drive the swarm.\x1b[0m\n`);
+
 export const startUiServer = async (options = {}) => {
   const port = options.port !== undefined ? options.port : 4173;
-  const host = options.host || '0.0.0.0';
+  const host = options.host || DEFAULT_UI_HOST;
   const cwd = options.cwd || process.cwd();
-  const { server, db } = createUiServer(cwd);
+  const auth = createUiAuth({ bindHost: host, token: options.token, allowHosts: options.allowHosts });
+  const { server, db } = createUiServer(cwd, { auth });
 
-  if (options.dev) {
+  const isDevMode = Boolean(options.dev);
+  if (isDevMode) {
     const { startUiDevWatcher } = await import('./ui-dev-watcher.js');
     const watcher = startUiDevWatcher(cwd, () => broadcastSseReload());
     server.on('close', () => watcher.close());
   }
-
   return new Promise((resolve, reject) => {
     server.on('error', (err) => {
       if (options.isCli) process.stderr.write(`\x1b[31m✖ UI error: ${err.message}\x1b[0m\n`);
@@ -81,13 +78,15 @@ export const startUiServer = async (options = {}) => {
     server.listen(port, host, () => {
       const addr = server.address();
       const actualPort = typeof addr === 'object' && addr ? addr.port : port;
-      const displayHost = host === '0.0.0.0' ? 'localhost' : host;
-      const url = `http://${displayHost}:${actualPort}`;
+      auth.cookieName = `chemx_ui_${actualPort}`;
+      const urlHost = resolveUiUrlHost(host);
+      const url = `http://${urlHost}:${actualPort}/?token=${auth.token}`;
       if (options.isCli) {
-        process.stdout.write(`\x1b[32m✔ Chemical X Live Swarm Web UI running at:\x1b[0m \x1b[36m${url}\x1b[0m\n`);
-        if (options.dev) process.stdout.write(`\x1b[35m🔥 Dev Hot Reload: ENABLED (watching UI files for instant updates)\x1b[0m\n`);
+        if (!isLoopbackHost(host)) warnPublicBind(host);
+        process.stdout.write(`\x1b[32m✔ Chemical X Live Swarm Web UI listening on ${host}:${actualPort}:\x1b[0m \x1b[36m${url}\x1b[0m\n`);
+        if (isDevMode) process.stdout.write(`\x1b[35m🔥 Dev Hot Reload: ENABLED (watching UI files for instant updates)\x1b[0m\n`);
       }
-      resolve({ server, port: actualPort, url, db });
+      resolve({ server, port: actualPort, url, db, token: auth.token, fetch: createUiFetch(auth.token) });
     });
   });
 };

package/cli/ui-sql-guard.js

@@ -0,0 +1,76 @@
+/**
+ * Chemical X UI SQL console guard.
+ * The DB Studio console is read-only: one SELECT/WITH/VALUES/EXPLAIN statement
+ * or a read-only PRAGMA. Everything else (ATTACH, DDL, DML, PRAGMA writes) is refused.
+ * The server also runs console SQL on a readOnly, query_only connection as a second wall.
+ */
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import { resolveIndexDbPath } from './search-schema.js';
+import { maskSqlLiteralsAndComments } from './ui-sql-mask.js';
+
+const READ_STATEMENT_START = /^(SELECT|WITH|VALUES|EXPLAIN|PRAGMA)\b/i;
+const WRITE_KEYWORDS = /\b(ATTACH|DETACH|INSERT|UPDATE|DELETE|CREATE|DROP|ALTER|VACUUM|REINDEX|ANALYZE)\b|\bREPLACE\s+INTO\b/i;
+const INTROSPECTION_PRAGMAS = new Set([
+  'table_info', 'table_xinfo', 'index_list', 'index_info', 'index_xinfo',
+  'foreign_key_list', 'foreign_key_check', 'integrity_check', 'quick_check'
+]);
+const QUERY_ONLY_PRAGMAS = new Set([
+  ...INTROSPECTION_PRAGMAS, 'table_list', 'database_list', 'collation_list', 'function_list',
+  'pragma_list', 'compile_options', 'page_size', 'page_count', 'freelist_count', 'journal_mode',
+  'busy_timeout', 'user_version', 'schema_version', 'application_id', 'encoding', 'auto_vacuum',
+  'cache_size', 'synchronous', 'foreign_keys', 'wal_autocheckpoint'
+]);
+const PRAGMA_SHAPE = /^PRAGMA\s+(?:\w+\.)?(\w+)\s*(\(\s*[\w"'.]+\s*\))?\s*$/i;
+
+export const CONSOLE_READ_ONLY_ERROR =
+  'Only SELECT, WITH, VALUES, EXPLAIN or read-only PRAGMA statements are permitted, one per request: the SQL console is read-only.';
+
+const isSingleStatement = (code) => {
+  const withoutTrailing = code.trim().replace(/;\s*$/, '');
+  return !withoutTrailing.includes(';');
+};
+
+const isReadOnlyPragma = (code) => {
+  const shape = code.trim().replace(/;\s*$/, '').match(PRAGMA_SHAPE);
+  if (!shape) return false;
+  const name = shape[1].toLowerCase();
+  const hasArgument = Boolean(shape[2]);
+  if (hasArgument) return INTROSPECTION_PRAGMAS.has(name);
+  return QUERY_ONLY_PRAGMAS.has(name);
+};
+
+/** Returns { allowed, reason } for a console statement. */
+export const classifyConsoleSql = (sql = '') => {
+  const masked = maskSqlLiteralsAndComments(sql);
+  const code = masked.code.trim();
+  if (!masked.isWellFormed) return { allowed: false, reason: CONSOLE_READ_ONLY_ERROR };
+  if (!code) return { allowed: false, reason: 'Empty SQL statement' };
+  const startsAsRead = READ_STATEMENT_START.test(code);
+  const isPragma = /^PRAGMA\b/i.test(code);
+  const hasWriteKeyword = WRITE_KEYWORDS.test(code);
+  const isAllowed = startsAsRead && isSingleStatement(code) && !hasWriteKeyword && (!isPragma || isReadOnlyPragma(code));
+  return isAllowed ? { allowed: true } : { allowed: false, reason: CONSOLE_READ_ONLY_ERROR };
+};
+
+export const CONSOLE_UNAVAILABLE_ERROR =
+  'SQL console unavailable: the read-only index connection could not be opened.';
+
+const loadDatabaseSync = () => {
+  try { return createRequire(import.meta.url)('node:sqlite').DatabaseSync; } catch { return null; }
+};
+
+const openReadOnly = (DatabaseSync, dbPath) => {
+  const connection = new DatabaseSync(dbPath, { readOnly: true });
+  connection.exec('PRAGMA query_only = 1');
+  return connection;
+};
+
+/** Opens a readOnly, query_only connection to the project index for the SQL console, or null. */
+export const openConsoleDb = (cwd = process.cwd()) => {
+  const DatabaseSync = loadDatabaseSync();
+  const dbPath = resolveIndexDbPath(cwd);
+  const hasIndex = Boolean(DatabaseSync) && fs.existsSync(dbPath);
+  if (!hasIndex) return null;
+  try { return openReadOnly(DatabaseSync, dbPath); } catch { return null; }
+};

package/cli/ui-sql-mask.js

@@ -0,0 +1,61 @@
+/**
+ * Single-pass SQL masker for the UI console guard.
+ * Walks the input left to right the way the SQLite tokenizer does, so the guard
+ * sees the same statement boundaries SQLite sees. Comments become a space,
+ * quoted strings and identifiers become an empty placeholder of the same quote.
+ * Returns { code, isWellFormed }: unterminated quotes or a NUL byte are not well formed.
+ */
+
+const QUOTE_CLOSERS = { "'": "'", '"': '"', '`': '`', '[': ']' };
+
+const findQuoteEnd = (sql, start, closer) => {
+  const allowsDoubling = closer !== ']';
+  let i = start + 1;
+  while (i < sql.length) {
+    const isCloser = sql[i] === closer;
+    const isDoubled = isCloser && allowsDoubling && sql[i + 1] === closer;
+    if (isDoubled) { i += 2; continue; }
+    if (isCloser) return i;
+    i += 1;
+  }
+  return -1;
+};
+
+const findLineCommentEnd = (sql, start) => {
+  const newline = sql.indexOf('\n', start);
+  return newline === -1 ? sql.length : newline;
+};
+
+const findBlockCommentEnd = (sql, start) => {
+  const close = sql.indexOf('*/', start + 2);
+  return close === -1 ? sql.length : close + 2;
+};
+
+export const maskSqlLiteralsAndComments = (sql = '') => {
+  const text = String(sql);
+  const hasNul = text.includes('\u0000');
+  if (hasNul) return { code: '', isWellFormed: false };
+  let code = '';
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    const pair = text.slice(i, i + 2);
+    const isLineComment = pair === '--';
+    const isBlockComment = pair === '/*';
+    const closer = QUOTE_CLOSERS[ch];
+    const isQuoteStart = Boolean(closer);
+    if (isLineComment) { code += ' '; i = findLineCommentEnd(text, i); continue; }
+    if (isBlockComment) { code += ' '; i = findBlockCommentEnd(text, i); continue; }
+    if (isQuoteStart) {
+      const end = findQuoteEnd(text, i, closer);
+      const isUnterminated = end === -1;
+      if (isUnterminated) return { code, isWellFormed: false };
+      code += ch + closer;
+      i = end + 1;
+      continue;
+    }
+    code += ch;
+    i += 1;
+  }
+  return { code, isWellFormed: true };
+};

package/cli/ui-sse.js

@@ -6,8 +6,7 @@ export const handleSseConnection = (req, res, db) => {
   res.writeHead(200, {
     'Content-Type': 'text/event-stream',
     'Cache-Control': 'no-cache, no-transform',
-    'Connection': 'keep-alive',
-    'Access-Control-Allow-Origin': '*'
+    'Connection': 'keep-alive'
   });
 
   try {
@@ -28,7 +27,8 @@ export const handleSseConnection = (req, res, db) => {
 };
 
 export const broadcastSseUpdate = (db) => {
-  if (clients.size === 0 || !db) return;
+  const isNotReady = clients.size === 0 || !db;
+  if (isNotReady) return;
   try {
     const state = handleSwarmStatus(db);
     const payload = `data: ${JSON.stringify(state)}\n\n`;
@@ -45,7 +45,8 @@ export const broadcastSseUpdate = (db) => {
 };
 
 export const broadcastSseReload = () => {
-  if (clients.size === 0) return;
+  const hasNoClients = clients.size === 0;
+  if (hasNoClients) return;
   const payload = `event: reload\ndata: ${JSON.stringify({ timestamp: Date.now() })}\n\n`;
   for (const client of clients) {
     try {

package/cli/ui-template-filetree.js

@@ -8,8 +8,8 @@ export const VIEW_FILETREE_TEMPLATE = `
         <div style="display:flex; gap:8px; align-items:center; flex-wrap:wrap;">
           <strong>🧬 Codebase AST Explorer & Inspector</strong>
           <span class="a-badge badge-primary">{{ codebaseFiles.length }} Files</span>
-          <span class="a-badge badge-lime">{{ cleanFileCount }} &le;100L</span>
-          <span class="a-badge badge-pink">{{ monolithFileCount }} &gt;100L</span>
+          <span class="a-badge badge-lime">{{ cleanFileCount }} within line budget</span>
+          <span class="a-badge badge-pink">{{ monolithFileCount }} over line budget</span>
           <span v-if="codebaseHazardCount > 0" class="badge-hazard">⚠️ {{ codebaseHazardCount }} Hazards</span>
         </div>
         <div style="display:flex; gap:6px; align-items:center;">
@@ -30,7 +30,7 @@ export const VIEW_FILETREE_TEMPLATE = `
             </div>
             <div v-else class="filetree-file" :class="{ 'filetree-file--selected': selectedFilePath === node.path }" @click="selectFile(node.path)">
               <span>📄</span><span style="flex:1; overflow:hidden; text-overflow:ellipsis; white-space:nowrap; font-size:11px;" :title="node.path">{{ node.name }}</span>
-              <span class="a-badge" :class="node.lines > 100 ? 'badge-pink' : 'badge-lime'">{{ node.lines }}L</span>
+              <span class="a-badge" :class="node.isOverBudget ? 'badge-pink' : 'badge-lime'">{{ node.lines }}L</span>
               <span class="a-badge badge-primary" style="font-size:9px;">{{ node.tier }}</span>
               <span class="a-badge" :class="node.healthScore < 80 ? 'badge-warning' : 'badge-lime'" style="font-size:9px;">{{ node.healthScore }}%</span>
               <span v-if="node.hazardCount > 0" class="badge-hazard" style="font-size:9px;">⚠️{{ node.hazardCount }}</span>
@@ -46,7 +46,7 @@ export const VIEW_FILETREE_TEMPLATE = `
               <div style="display:flex; justify-content:space-between; align-items:center; flex-wrap:wrap; gap:6px;">
                 <strong style="color:#62c9ff; font-size:12px; word-break:break-all;">{{ selectedFileDetail.file.path }}</strong>
                 <div style="display:flex; gap:6px; align-items:center;">
-                  <span class="a-badge" :class="selectedFileDetail.file.lines > 100 ? 'badge-pink' : 'badge-lime'">{{ selectedFileDetail.file.lines }} Lines</span>
+                  <span class="a-badge" :class="selectedFileDetail.file.isOverBudget ? 'badge-pink' : 'badge-lime'">{{ selectedFileDetail.file.lines }} Lines</span>
                   <span class="a-badge badge-primary">{{ selectedFileDetail.file.tier }}</span>
                   <span class="a-badge badge-lime">Health: {{ selectedFileDetail.file.healthScore }}%</span>
                   <span v-if="selectedFileDetail.file.hazardCount > 0" class="badge-hazard">⚠️ {{ selectedFileDetail.file.hazardCount }} Hazards</span>

package/cli/ui-template-kanban.js

@@ -1,3 +1,4 @@
+import { formatTaskTokenStamp } from './team/team-telemetry.js';
 import { TASK_DETAILS_SHEET_TEMPLATE } from './ui-template-task-sheet.js';
 
 export const KANBAN_COLUMNS = [
@@ -14,12 +15,8 @@ export const groupTasksByColumn = (tasks = []) => ({
   blocked: tasks.filter((t) => t.status === 'blocked' || t.status === 'failed')
 });
 
-export const formatKanbanTokenStamp = (t = {}) => {
-  const p = Number(t.prompt_tokens || 250);
-  const c = Number(t.completion_tokens || 45);
-  const cost = t.cost_usd != null ? Number(t.cost_usd) : ((p * 0.000003) + (c * 0.000015));
-  return `[P: ${p} | C: ${c} | Cost: $${cost.toFixed(4)}]`;
-};
+// Never invent tokens for an unmeasured task; the stamp says unknown.
+export const formatKanbanTokenStamp = (t = {}) => formatTaskTokenStamp(t);
 
 export const VIEW_KANBAN_TEMPLATE = `
     <!-- 5-Column Kanban: Queued, In Progress, Review, Completed, Blocked -->
@@ -67,7 +64,7 @@ export const VIEW_KANBAN_TEMPLATE = `
               <span class="a-badge badge-warning" style="font-size:9px;">{{ (t.vds_priority || 'medium').toUpperCase() }}</span>
               <span class="a-badge badge-primary" style="cursor:pointer;" title="Click to view agent profile" @click="openAgentProfile(t.assigned_agent_id || t.assignedAgentId)">{{ t.assigned_agent_id || t.assignedAgentId || '@unassigned' }}</span>
             </div>
-            <span class="vb-token-stamp">{{ t.tokenStamp || ('[P: ' + (t.prompt_tokens || 250) + ' | C: ' + (t.completion_tokens || 45) + ' | Cost: $' + (Number(t.cost_usd || 0.0014)).toFixed(4) + ']') }}</span>
+            <span class="vb-token-stamp">{{ t.tokenStamp || '[tokens: unknown]' }}</span>
 
             <div v-if="taskRefusals && taskRefusals[t.id]" style="background:#450a0a; border:1px solid #dc2626; color:#fca5a5; padding:5px 6px; border-radius:3px; margin:4px 0; font-size:10px;">
               <strong>⛔ Verification Refused:</strong> {{ taskRefusals[t.id].message }}

package/cli/verify-changed.js

@@ -0,0 +1,43 @@
+// `chemx verify --changed`: the audit covers only the changed source files and the tests only
+// the affected specs; typecheck stays whole-project (types cross every file) and says so.
+import path from 'node:path';
+import { listChangedFiles } from './test-changes.js';
+import { isSourceFilePath } from './audit-preflight-git.js';
+import { ANSI } from './theme.js';
+import { STATUS } from './result-status.js';
+import { changedPackages, runPerPackage, changeNotes, rootOrAllPackages } from './workspace-run.js';
+
+// Returns { ok, base, files } (root-relative source files that still exist) or { ok: false, error }.
+export const resolveVerifyChanges = (root, base = null) => {
+  const listing = listChangedFiles(root, { base });
+  const isListingFailed = !listing.ok;
+  if (isListingFailed) return { ok: false, error: listing.error };
+  const files = listing.files.filter((f) => f.status !== 'D' && isSourceFilePath(f.path)).map((f) => f.path);
+  return { ok: true, base: listing.base, files };
+};
+
+export const changedAuditOptions = (root, changes) => ({ fileList: changes.files.map((file) => path.join(root, file)) });
+
+export const testArgsFor = (changes, base) => (changes ? ['--changed', ...(base ? [`--base=${base}`] : [])] : []);
+
+// verify at a monorepo root: --changed verifies each package that owns a changed file,
+// --all-packages verifies every package, anything else is refused with the package list.
+// runInPackage(pkg, args) resolves to that package's own verify summary.
+export const verifyWorkspace = async (workspace, { changed, base, allPackages }, runInPackage) => {
+  if (!changed) return rootOrAllPackages(workspace, 'verify', allPackages, (pkg) => runInPackage(pkg, []));
+  const changes = changedPackages(workspace, base);
+  const isChangesFailed = !changes.ok;
+  if (isChangesFailed) return { status: STATUS.INCONCLUSIVE, success: false, reason: 'NO_CHANGES', error: `cannot list changed files: ${changes.error}`, packages: [] };
+  const args = testArgsFor(changes, base);
+  const extraStatuses = changes.rootManifests.length > 0 || changes.packages.length === 0 ? [STATUS.INCONCLUSIVE] : [];
+  const units = changes.packages.map((pkg) => ({ pkg, args }));
+  return runPerPackage(units, (unit) => runInPackage(unit.pkg, unit.args), { base: changes.base, dependents: changes.dependents, rootFiles: changes.rootFiles, notes: changeNotes(changes), extraStatuses });
+};
+
+export const formatVerifyLine = (entry) => {
+  const steps = ['audit', 'typecheck', 'tests'].map((step) => `${step} ${entry[step]?.status ?? '-'}`).join(', ');
+  const icon = entry.status === STATUS.PASS ? `${ANSI.LIME}✔` : `${ANSI.RED}✖`;
+  const excluded = Array.isArray(entry.scope?.excluded) ? entry.scope.excluded : [];
+  const scopeLine = excluded.length > 0 ? `    ${ANSI.DIM}audited ${entry.scope.dir}/; not audited: ${excluded.join(", ")} (--all-packages runs their own audits)${ANSI.RESET}\n` : "";
+  return `  ${icon}${ANSI.RESET} ${entry.status} ${ANSI.DIM}(${steps})${ANSI.RESET}\n${scopeLine}`;
+};