@dadado/agent-kit-cli 5.6.0 → 5.7.0

package/README.md

@@ -43,6 +43,8 @@ agent-kit dashboard
 
 The panel binds to loopback by default, serves its own static files, and snapshots the current workspace. L0 install does **not** copy `dashboard/` into your app; `agent-kit dashboard` resolves the panel from the installed package.
 
+Browser-free: `agent-kit mission-control` is a third surface (ASCII Mission, Flight Log, Checklist, Crew Monitor) that reuses the same snapshot builders without starting the HTTP server. `agent-kit mission-control --once` prints one frame (Claude Code `/agent-kit`). The web dashboard stays shipped.
+
 Older tags before 4.8.2 do not include those assets. Prefer a current pin, or point `MISSION_CONTROL_KIT_ROOT` / `AGENT_KIT_HOME` at an agent-kit checkout that contains `dashboard/`.
 
 ## Bare invoke (welcome)
@@ -73,7 +75,8 @@ On an interactive TTY, long-running commands (`init`, `install`, `doctor`, `upda
 | `agent-kit doctor` | Diagnose repository readiness (`--json` includes an `env` pillar: bin-on-PATH, npm prefix writability, Node version, shell profile) |
 | `agent-kit setup-global` | Self-heal a root-owned npm global prefix (relocate to `~/.npm-global`, fix `PATH`, reinstall) |
 | `agent-kit update` | Re-apply L0/packs/skills from the registry |
-| `agent-kit dashboard` | Start Mission Control for this workspace |
+| `agent-kit dashboard` | Start Mission Control for this workspace (browser panel) |
+| `agent-kit mission-control` | ASCII Mission Control TUI (`--once` for one frame) |
 | `agent-kit add <id>` | Install a skill or L1 pack |
 | `agent-kit run-plan` | Headless continuous plan runner (never promotes to production) |
 

package/dashboard/README.md

@@ -23,3 +23,20 @@ before it fans out to the workspace packages).
 
 `dashboard.html` is outside Biome's scope; CSS/HTML-only changes are covered by
 `packages/cli/src/dashboard/plugin-ux-validation.test.ts` instead.
+
+## Git tab and DevOps tab
+
+The Git tab (`#git`) keeps the pre-rendered `git log --graph` markdown block and adds a
+second, state-colored visual tree next to it, reusing the `.now-stepper`/`.now-step-marker`
+timeline component built for the Current Mission panel (`renderGitVisualTree` in
+`dashboard.html`, parsing `SNAPSHOT.git.graph`). It is single-lane by design — the markdown
+block keeps the true branch-lane geometry; the stepper trades that for an at-a-glance
+promotion read (HEAD, promoted to `origin/main`/`origin/staging`, or neither).
+
+The DevOps tab (`#devops`) is scoped to CI/CD + deploy signal, separate from the
+local-process-only Processes tab. `dashboard-data.mjs`'s `collectPipelineRuns()` shells to
+`gh run list` (budget-guarded via `withinSnapshotBudget()`, fails soft to an honest
+empty-state when `gh` is unavailable/unauthenticated); `collectDeploySignal()` reads `v*`
+git tags plus the latest non-`Unreleased` `CHANGELOG.md` entry as a best-effort "what
+shipped recently" proxy. Neither collector polls live infra/hosting — the DevOps tab never
+implies monitoring it does not perform.

package/dashboard/dashboard-data.mjs

@@ -49,13 +49,33 @@ const MAX_TERMINALS = 20;
 const MAX_PROCESSES = 25;
 const MAX_GIT_GRAPH_LINES = 25;
 const MAX_GIT_GRAPH_LINE_CHARS = 160;
+const MAX_PIPELINE_RUNS = 5;
+const MAX_PIPELINE_NAME_CHARS = 80;
+// Live-measured (2026-08-24, this repo, 8 fresh `gh run list` samples via the
+// exact trimmed command): 3476-6584ms, one earlier ad-hoc sample 7674ms.
+// Prior review sessions (.cursor/memory/plan-monitor-mc-git-tab-visual-tree-and-devops-panel.md)
+// spanned 2.1-9.9s. 3500ms had no headroom at all over that range; 12000ms
+// gives real margin over the observed worst case (~2.1s over the historical
+// 9.9s max, ~4.3s over this session's tight-sample max) while staying well
+// under the 60s outer child-process timeout (serve.mjs DATA_SCRIPT_TIMEOUT_MS).
+const GH_RUN_LIST_TIMEOUT_MS = 12_000;
+const MAX_DEPLOY_TAGS = 5;
+const MAX_DEPLOY_TAG_NAME_CHARS = 64;
+const MAX_CHANGELOG_ITEMS = 4;
+const MAX_CHANGELOG_ITEM_CHARS = 140;
 
 /** Soft wall-clock budget for optional collectors (transcripts, reports, ps). */
 const SNAPSHOT_STARTED_MS = Date.now();
+// Default raised from 12000ms by the same delta GH_RUN_LIST_TIMEOUT_MS grew
+// (3500ms -> 12000ms, +8500ms): collectPipelineRuns() now runs last among the
+// budget-guarded collectors and reserves GH_RUN_LIST_TIMEOUT_MS + 400ms of
+// budget before attempting `gh run list` (see withinSnapshotBudget call
+// there), so the total budget must grow by the same amount the reserve did
+// or the larger timeout can never actually be used.
 const SNAPSHOT_BUDGET_MS = (() => {
   const raw = process.env.AGENT_KIT_DASHBOARD_DATA_BUDGET_MS;
-  const n = raw != null && raw !== "" ? Number(raw) : 12_000;
-  return Number.isFinite(n) && n > 0 ? n : 12_000;
+  const n = raw != null && raw !== "" ? Number(raw) : 20_500;
+  return Number.isFinite(n) && n > 0 ? n : 20_500;
 })();
 function withinSnapshotBudget(reserveMs = 400) {
   return Date.now() - SNAPSHOT_STARTED_MS + reserveMs < SNAPSHOT_BUDGET_MS;
@@ -104,7 +124,7 @@ function redactTerminalOutput(text) {
 
 const SNAPSHOT = {
   _schema: {
-    version: "1.2.0",
+    version: "1.3.0",
     description: "Mission Control dashboard data model",
     fields: {
       generatedAt: "ISO-8601 timestamp of snapshot generation",
@@ -117,6 +137,8 @@ const SNAPSHOT = {
       memory:
         "Memory records: error count, decision count, recent decisions, recent parsed errors, error-o-meter stats",
       git: "Git repository state: branch, dirty status, commit, ahead/behind, bounded files[], promotion flow vs staging/main, graph lines, staging hygiene",
+      devops:
+        "Best-effort DevOps signal: pipeline ({available, runs[], reason?} recent gh run list rows; reason is 'budget' when the shared snapshot budget ran out before gh was attempted, or 'call-failed' when gh was attempted and missing/unauthenticated/timed out/errored; reason is only present when available is false) and deploy ({tags[], changelog} v* git tags + latest CHANGELOG release entry as a 'what shipped recently' proxy, not a live infra poll)",
       terminals:
         "Active Cursor terminal sessions with metadata, output line count, and capped lastOutput",
       processes:
@@ -127,7 +149,7 @@ const SNAPSHOT = {
     },
   },
   generatedAt: new Date().toISOString(),
-  dashboardDataVersion: "1.3.0",
+  dashboardDataVersion: "1.4.0",
   plans: [],
   system: {
     repoRoot: ROOT,
@@ -246,6 +268,7 @@ const kitCommandPaths = new Set();
 const kitSkillDirs = new Set();
 const kitAgentPaths = new Set();
 const registryFile = join(ROOT, "registry", "registry.json");
+let registryHadCommands = false;
 if (existsSync(registryFile)) {
   try {
     const registry = JSON.parse(readFileSync(registryFile, "utf8"));
@@ -265,10 +288,58 @@ if (existsSync(registryFile)) {
         kitAgentPaths.add(entry.path);
       }
     }
+    registryHadCommands = kitCommandPaths.size > 0;
   } catch {
     // Unreadable registry: degrade to all-editable rather than locking everything.
   }
 }
+// `registry/registry.json` is a factory-only artifact index — consumer installs
+// never ship it, so the block above always leaves kitCommandPaths empty there and
+// every command reads kitManaged: false even though `update` owns it. Fall back to
+// the locally-tracked kit markers: `.cursor/agent-kit.managed-hashes.json` (already
+// keyed by the same repo-relative path as c.path / a.path) and, as a secondary
+// source, `.cursor/agent-kit.json`'s `protected[]` list (exact paths only; glob
+// entries like `.cursor/plans/**` don't identify individual kit-managed commands so
+// they're skipped). Only engages when the registry is absent or yielded no commands,
+// so factory behavior (registry present + populated) is unchanged.
+if (!registryHadCommands) {
+  const managedHashesFile = join(ROOT, ".cursor", "agent-kit.managed-hashes.json");
+  const agentKitConfigFile = join(ROOT, ".cursor", "agent-kit.json");
+  const fallbackPaths = new Set();
+  if (existsSync(managedHashesFile)) {
+    try {
+      const managed = JSON.parse(readFileSync(managedHashesFile, "utf8"));
+      const hashes = managed?.hashes && typeof managed.hashes === "object" ? managed.hashes : {};
+      for (const path of Object.keys(hashes)) {
+        fallbackPaths.add(path);
+      }
+    } catch {
+      // Unreadable managed-hashes.json: fall through to protected[] (if any).
+    }
+  }
+  if (existsSync(agentKitConfigFile)) {
+    try {
+      const agentKitConfig = JSON.parse(readFileSync(agentKitConfigFile, "utf8"));
+      const protectedList = Array.isArray(agentKitConfig?.protected)
+        ? agentKitConfig.protected
+        : [];
+      for (const entry of protectedList) {
+        if (typeof entry === "string" && !entry.includes("*")) fallbackPaths.add(entry);
+      }
+    } catch {
+      // Unreadable agent-kit.json: managed-hashes.json (if any) still applies.
+    }
+  }
+  for (const path of fallbackPaths) {
+    if (path.startsWith(".cursor/commands/")) {
+      kitCommandPaths.add(path);
+    } else if (path.startsWith(".cursor/agents/")) {
+      kitAgentPaths.add(path);
+    } else if (path.startsWith(".cursor/skills/") && path.endsWith("/SKILL.md")) {
+      kitSkillDirs.add(path.slice(0, -"/SKILL.md".length));
+    }
+  }
+}
 for (const c of SNAPSHOT.commands) {
   c.kitManaged = kitCommandPaths.has(c.path);
 }
@@ -402,7 +473,12 @@ if (existsSync(memoryDecisionsDir)) {
 try {
   const gitOpts = { cwd: ROOT, encoding: "utf-8", timeout: 5000 };
   const branch = execSync("git rev-parse --abbrev-ref HEAD", gitOpts).trim();
-  const status = execSync("git status --short", gitOpts).trim();
+  // Only strip the trailing newline(s) here — `git status --short` uses
+  // positional XY status columns, so an unstaged-only row starts with a
+  // literal leading space (e.g. " M path"). A full-string .trim() eats that
+  // leading space on line 1 only, shifting parseGitStatusShort's staged /
+  // unstaged read for the first row.
+  const status = execSync("git status --short", gitOpts).replace(/\n+$/, "");
   const lastCommit = execSync("git log -1 --oneline", gitOpts).trim();
   let ahead = 0;
   let behind = 0;
@@ -487,6 +563,128 @@ try {
   SNAPSHOT._gitRecentLog = [];
 }
 
+// 6b. DevOps: CI/CD pipeline status (best-effort, `gh` CLI) + a "what shipped
+// recently" deploy-activity proxy from v* git tags and the latest CHANGELOG
+// release entry. Both fail soft to an empty/unavailable shape; this snapshot
+// never blocks or errors on either signal, and never claims live
+// infra/hosting monitoring it does not perform.
+function collectPipelineRuns() {
+  // gh run list is a network call, unlike the local-only git collectors
+  // above; the budget reserve must cover its own timeout, not just a nominal
+  // buffer (see .cursor/memory/errors/2026-07-26_mission-control-dashboard-data-timeout.md
+  // for why this file's soft-budget guards exist).
+  if (!withinSnapshotBudget(GH_RUN_LIST_TIMEOUT_MS + 400)) {
+    // `gh` was never even attempted this snapshot — the shared budget ran out
+    // first. Distinguished from a failed/timed-out call below so the UI does
+    // not misattribute this (the dominant real case; see live measurements
+    // in .cursor/memory/plan-monitor-mc-git-tab-visual-tree-and-devops-panel.md
+    // and the residual note this fix landed from) to an auth/install problem.
+    return { available: false, runs: [], reason: "budget" };
+  }
+  try {
+    // Trimmed to the fields renderDevopsPipelineCard() / navDevopsDot actually
+    // read (workflow, status, conclusion, branch, event, createdAt). databaseId
+    // and url are dropped: the pipeline card is display-only with no
+    // paste-destination for a run URL (ADR 2026-07-25 copy-only convention),
+    // so requesting them only adds payload cost without a consumer.
+    const out = execSync(
+      `gh run list --limit ${MAX_PIPELINE_RUNS} --json workflowName,status,conclusion,headBranch,event,createdAt`,
+      { cwd: ROOT, encoding: "utf-8", timeout: GH_RUN_LIST_TIMEOUT_MS },
+    );
+    const rows = JSON.parse(out);
+    if (!Array.isArray(rows)) return { available: false, runs: [], reason: "call-failed" };
+    const runs = rows.slice(0, MAX_PIPELINE_RUNS).map((r) => ({
+      workflow: truncateStr(String(r.workflowName || ""), MAX_PIPELINE_NAME_CHARS),
+      status: String(r.status || ""),
+      conclusion: r.conclusion ? String(r.conclusion) : null,
+      branch: truncateStr(String(r.headBranch || ""), MAX_STRING.branch),
+      event: String(r.event || ""),
+      createdAt: r.createdAt || null,
+    }));
+    return { available: true, runs };
+  } catch {
+    // gh missing, unauthenticated, its own execSync timeout, or non-repo cwd
+    // all read the same to the caller: no pipeline signal for this snapshot.
+    // Not further split (e.g. timeout vs auth) — that would need parsing the
+    // execSync error shape, which is more taxonomy than the empty-state copy
+    // needs; "call-failed" is enough to stop the UI from guessing "auth".
+    return { available: false, runs: [], reason: "call-failed" };
+  }
+}
+
+/** Markdown decoration removed, not converted (mirrors scripts/build-landing.mjs's
+ * stripMdInline): safe against unclosed tokens after the item-length cap below. */
+function stripMdInlineForDeploySignal(s) {
+  return s
+    .replace(/\[([^\]]+)\]\([^)]+\)/g, "$1")
+    .replace(/\*\*([^*]+)\*\*/g, "$1")
+    .replace(/`([^`]+)`/g, "$1");
+}
+
+/** First non-"Unreleased" `## [x.y.z] - date` entry and a capped bullet list. */
+function parseLatestChangelogEntryForDeploySignal(changelog) {
+  const headerRe = /^## \[([^\]]+)\](?:\s*-\s*(.+))?$/gm;
+  const headers = [...changelog.matchAll(headerRe)];
+  const latest = headers.find((m) => m[1].toLowerCase() !== "unreleased");
+  if (!latest) return null;
+  const start = latest.index + latest[0].length;
+  const next = headers.find((m) => m.index > latest.index);
+  const body = changelog.slice(start, next ? next.index : undefined);
+  const items = [...body.matchAll(/^- (.+)$/gm)]
+    .map((m) => stripMdInlineForDeploySignal(m[1].trim()))
+    .filter(Boolean)
+    .slice(0, MAX_CHANGELOG_ITEMS)
+    .map((line) =>
+      line.length > MAX_CHANGELOG_ITEM_CHARS
+        ? `${line.slice(0, MAX_CHANGELOG_ITEM_CHARS).trimEnd()}…`
+        : line,
+    );
+  return { version: latest[1], date: (latest[2] || "").trim() || null, items };
+}
+
+function collectDeploySignal() {
+  if (!withinSnapshotBudget(400)) return { tags: [], changelog: null };
+  const gitOpts = { cwd: ROOT, encoding: "utf-8", timeout: 5000 };
+  let tags = [];
+  try {
+    // v*-only: an archive/* or other non-release tag under "what shipped
+    // recently" would be exactly the misleading signal this phase avoids.
+    const out = execSync(
+      `git for-each-ref --sort=-creatordate --format='%(refname:short)|%(creatordate:short)' --count=${MAX_DEPLOY_TAGS} 'refs/tags/v*'`,
+      gitOpts,
+    ).trim();
+    tags = out
+      ? out
+          .split("\n")
+          .filter(Boolean)
+          .map((line) => {
+            const [name, date] = line.split("|");
+            return { name: truncateStr(name || "", MAX_DEPLOY_TAG_NAME_CHARS), date: date || null };
+          })
+      : [];
+  } catch {
+    tags = [];
+  }
+
+  let changelog = null;
+  try {
+    const changelogPath = join(ROOT, "CHANGELOG.md");
+    if (existsSync(changelogPath)) {
+      changelog = parseLatestChangelogEntryForDeploySignal(readFileSync(changelogPath, "utf-8"));
+    }
+  } catch {
+    changelog = null;
+  }
+
+  return { tags, changelog };
+}
+
+// SNAPSHOT.devops is assigned near the end of the snapshot build (after the
+// transcripts/reports/ps collectors below), not here — gh run list is a
+// network call that must not run ahead of and starve the local-only
+// budget-guarded collectors that share SNAPSHOT_BUDGET_MS. See the call site
+// right before the missionControl assembly for the ordering rationale.
+
 // 7. Terminals (read from Cursor terminal files)
 const terminalsDir = resolve(process.env.HOME || "~", ".cursor", "projects");
 // Derive project path from ROOT rather than hardcoding a specific slug
@@ -1142,4 +1340,16 @@ function readPreviousInventory() {
 }
 SNAPSHOT._gitRecentLog = undefined;
 
+// DevOps: CI/CD pipeline status (best-effort, `gh` CLI) + a "what shipped
+// recently" deploy-activity proxy. Deliberately collected last, after every
+// other budget-guarded collector above (processes, detached-audit-sessions,
+// agentPrompts, externalReports, subagentRuns): collectPipelineRuns() makes
+// a network call (gh run list) unlike every other collector in this file, so
+// it must not run ahead of and eat into the shared SNAPSHOT_BUDGET_MS budget
+// that the local-only collectors also need.
+SNAPSHOT.devops = {
+  pipeline: collectPipelineRuns(),
+  deploy: collectDeploySignal(),
+};
+
 process.stdout.write(JSON.stringify(SNAPSHOT, null, 2));

package/dashboard/dashboard.html

@@ -1173,6 +1173,45 @@ body.mc-fullscreen .top-tabs-row {
   color: var(--text-secondary);
   margin: 12px 0 6px;
 }
+.git-graph-title:first-child { margin-top: 0; }
+
+/* ===== DevOps ===== */
+/* Row visual language mirrors .git-flow-row (state dot + lane + meta) so the
+ * new tab reads as the same product, not a second component vocabulary. */
+.devops-row {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  font-size: 12px;
+  padding: 8px 10px;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  background: var(--bg-card);
+  flex-wrap: wrap;
+  margin-bottom: 6px;
+}
+.devops-row:last-child { margin-bottom: 0; }
+.devops-name {
+  font-weight: 600;
+  color: var(--text-primary);
+  flex-shrink: 0;
+}
+.devops-meta {
+  color: var(--text-secondary);
+  flex: 1;
+  min-width: 0;
+}
+.devops-time {
+  color: var(--text-muted);
+  font-family: var(--mc-font-mono);
+  font-size: 11px;
+  flex-shrink: 0;
+}
+.devops-note {
+  font-size: 11px;
+  color: var(--text-muted);
+  margin: 0 0 8px;
+}
 .git-hygiene {
   display: flex;
   align-items: flex-start;
@@ -3644,6 +3683,10 @@ html[data-monitor-density="comfortable"] .live-activity-feed .monitor-row .monit
           Git
           <span class="dot dot-gray" id="navGitDot" aria-hidden="true"></span>
         </a>
+        <a class="top-tab nav-more-item" role="menuitem" href="#" data-section="devops" tabindex="0" onclick="return showSection('devops')" aria-label="DevOps section">
+          DevOps
+          <span class="dot dot-gray" id="navDevopsDot" aria-hidden="true"></span>
+        </a>
         <a class="top-tab nav-more-item" role="menuitem" href="#" data-section="memory" tabindex="0" onclick="return showSection('memory')" aria-label="Memory section">
           Memory
         </a>
@@ -3819,6 +3862,7 @@ const SECTION_IDS = [
   'commands',
   'health',
   'git',
+  'devops',
   'memory',
   'terminals',
   'processes',
@@ -5430,6 +5474,199 @@ function renderGitGraphCard(git) {
   `;
 }
 
+/** Cap for the visual tree row count (mirrors MAX_GIT_GRAPH_LINES server-side cap, further
+ * bounded here so the stepper stays a glance, not a scroll well). */
+const MAX_GIT_VISUAL_TREE_ROWS = 12;
+
+/**
+ * Parse `git log --graph --oneline --decorate` lines into flattened commit
+ * entries. Connector-only lines (`|`, `/`, `\`, whitespace between lanes)
+ * carry no commit and are skipped — see the plan's "Phase 0 lane-flattening
+ * interpretation" note: this trades true branch-lane geometry (still fully
+ * present in the kept markdown block) for one row per commit.
+ */
+function parseGitGraphCommits(lines) {
+  const commits = [];
+  for (const line of Array.isArray(lines) ? lines : []) {
+    const m = /\*\s*([0-9a-f]{4,40})\s+(?:\(([^)]*)\)\s*)?(.*)$/.exec(line);
+    if (!m) continue;
+    const decoration = (m[2] || '').trim();
+    commits.push({
+      hash: m[1],
+      decoration,
+      subject: (m[3] || '').trim(),
+      isHead: /\bHEAD\b/.test(decoration),
+      isPromoted: /\borigin\/(main|staging)\b/.test(decoration),
+    });
+  }
+  return commits;
+}
+
+/**
+ * Visual companion to the markdown git-graph block: reuses the exact
+ * .now-stepper/.now-step/.now-step-marker timeline primitive (state-colored
+ * markers + connecting line) with one row per parsed commit. Dot/marker
+ * semantics stay locked to the existing Now-panel vocabulary: current/blue =
+ * HEAD, done/green = already promoted to origin/main or origin/staging,
+ * neutral = neither. Degrades to a compact empty-state when the graph has no
+ * parseable commit line (e.g. a shallow clone) while a branch still exists.
+ */
+function renderGitVisualTree(git) {
+  const commits = parseGitGraphCommits(git?.graph);
+  if (!commits.length) {
+    if (!git?.branch) return '';
+    return renderEmptyStateCta({
+      headline: 'No visual tree yet',
+      support: 'The commit graph had no parseable commit line to render.',
+      compact: true,
+      className: 'git-visual-tree-empty',
+    });
+  }
+  const shown = commits.slice(0, MAX_GIT_VISUAL_TREE_ROWS);
+  const rows = shown
+    .map((c) => {
+      const stateClass = c.isHead ? ' now-step-current' : c.isPromoted ? ' now-step-done' : '';
+      const marker = c.isHead ? '●' : c.isPromoted ? '✓' : '○';
+      const label = c.decoration ? escapeHtml(c.decoration) : 'Commit';
+      const text = `<span class="now-todo-id">${escapeHtml(c.hash)}</span>${c.subject ? ` — ${escapeHtml(c.subject)}` : ''}`;
+      return `
+        <li class="now-step${stateClass}">
+          <span class="now-step-marker" aria-hidden="true">${marker}</span>
+          <div class="now-step-body">
+            <span class="now-step-label">${label}</span>
+            <div class="now-step-text">${text}</div>
+          </div>
+        </li>
+      `;
+    })
+    .join('');
+  return `
+    <div class="git-graph-title">Visual tree (${shown.length} of ${commits.length} commit${commits.length !== 1 ? 's' : ''})</div>
+    <ol class="now-stepper git-visual-tree" aria-label="Visual commit tree: state-colored markers by promotion status">
+      ${rows}
+    </ol>
+  `;
+}
+
+/** `in_progress` / `timed_out` -> `In progress` / `Timed out`. */
+function humanizeRunStatus(s) {
+  const raw = String(s || '').trim();
+  if (!raw) return 'Unknown';
+  return raw
+    .split('_')
+    .map((w) => (w ? w[0].toUpperCase() + w.slice(1) : w))
+    .join(' ');
+}
+
+/** Dot tone for one `gh run list` row: in-flight states read yellow; a
+ * completed run reads by conclusion (green/red/yellow), never decorative. */
+function pipelineRunTone(run) {
+  if (run.status !== 'completed') return 'yellow';
+  if (run.conclusion === 'success') return 'green';
+  if (['failure', 'cancelled', 'timed_out'].includes(run.conclusion)) return 'red';
+  return 'yellow';
+}
+
+/**
+ * CI/CD pipeline card (Phase 2): recent `gh run list` rows, honest empty-state
+ * when the collector didn't produce runs. Display only, no CTA — a
+ * workflow-run URL has no named paste destination in the copy-only
+ * convention (ADR 2026-07-25), so this card ships without one rather than
+ * inventing a destination.
+ *
+ * Empty-state copy is keyed off `pipeline.reason` rather than one blanket
+ * message: live measurement (2026-08-24, mc-git-tab-devops-pipeline-timeout
+ * residuals) found the dominant real case is the shared snapshot budget
+ * running out before `gh` is even attempted ('budget'), not gh being
+ * missing/unauthenticated — the old unconditional "gh is unavailable or not
+ * authenticated" copy misattributed that case and pointed the operator at
+ * the wrong fix.
+ */
+function renderDevopsPipelineCard(devops) {
+  const pipeline = devops?.pipeline || null;
+  if (!pipeline?.available) {
+    const support = pipeline?.reason === 'budget'
+      ? 'This snapshot ran out of time before checking recent workflow runs — refresh to retry.'
+      : 'Recent workflow runs could not be read this snapshot (gh may be missing, unauthenticated, or the call timed out).';
+    return renderEmptyStateCta({
+      headline: 'No pipeline signal',
+      support,
+      compact: true,
+      className: 'devops-pipeline-empty',
+    });
+  }
+  const runs = pipeline.runs || [];
+  if (!runs.length) {
+    return renderEmptyStateCta({
+      headline: 'No recent runs',
+      support: 'No GitHub Actions workflow runs found for this repository.',
+      compact: true,
+      className: 'devops-pipeline-empty',
+    });
+  }
+  const rows = runs
+    .map((r) => {
+      const tone = pipelineRunTone(r);
+      const label = humanizeRunStatus(r.status === 'completed' ? r.conclusion || 'unknown' : r.status);
+      return `
+        <div class="devops-row">
+          <span class="dot dot-${tone}" aria-hidden="true"></span>
+          <span class="devops-name">${escapeHtml(r.workflow || 'Workflow')}</span>
+          <span class="devops-meta">${escapeHtml(label)} · ${escapeHtml(r.branch || '—')} · ${escapeHtml(r.event || '—')}</span>
+          <span class="devops-time">${escapeHtml(fmtDate(r.createdAt))}</span>
+        </div>
+      `;
+    })
+    .join('');
+  return rows;
+}
+
+/**
+ * Deploy-activity card (Phase 3, best-effort, honest): a "what shipped
+ * recently" proxy from `v*` git tags and the latest non-Unreleased CHANGELOG
+ * entry. Deliberately not a live infra/hosting poll — no fabricated service
+ * tiles for sources this dashboard does not actually reach.
+ */
+function renderDevopsDeployCard(devops) {
+  const deploy = devops?.deploy || null;
+  const tags = deploy?.tags || [];
+  const changelog = deploy?.changelog || null;
+  if (!tags.length && !changelog) {
+    return renderEmptyStateCta({
+      headline: 'No deploy signal yet',
+      support: 'No git release tags (v*) or a parseable CHANGELOG release entry were found. This section reflects what shipped, from tags and CHANGELOG only — it does not poll live infra or hosting.',
+      compact: true,
+      className: 'devops-deploy-empty',
+    });
+  }
+  const changelogRow = changelog
+    ? `
+      <div class="devops-row">
+        <span class="dot dot-green" aria-hidden="true"></span>
+        <span class="devops-name">CHANGELOG ${escapeHtml(changelog.version)}</span>
+        <span class="devops-meta">${escapeHtml((changelog.items || []).join(' · ') || 'Release notes')}</span>
+        <span class="devops-time">${escapeHtml(changelog.date || '—')}</span>
+      </div>
+    `
+    : '';
+  const tagRows = tags
+    .map(
+      (t) => `
+      <div class="devops-row">
+        <span class="dot dot-gray" aria-hidden="true"></span>
+        <span class="devops-name">${escapeHtml(t.name)}</span>
+        <span class="devops-meta">git tag</span>
+        <span class="devops-time">${escapeHtml(t.date || '—')}</span>
+      </div>
+    `,
+    )
+    .join('');
+  return `
+    <div class="devops-note">Best-effort "what shipped recently" from git tags + CHANGELOG — not a live infra/deploy poll.</div>
+    ${changelogRow}${tagRows}
+  `;
+}
+
 /** Staging hygiene: untracked plan-monitor WIP (add-by-name only; ADR 2026-07-29 R14). */
 function renderGitHygieneHint(git) {
   const wip = git?.hygiene?.monitorWip || [];
@@ -6788,7 +7025,7 @@ function nowMetaIconSvg(kind, opts) {
  * features >= 1 unit. Detail that cannot meet the floor is drawn filled
  * (fill="currentColor" stroke="none"), never as a sub-stroke stroked shape.
  * Static path markup only; never concatenate untrusted text into the SVG.
- * @param {'current-mission'|'monitor'|'field-report'|'checklist'|'more-sections'|'overview'|'plans'|'activity'|'agents'|'skills'|'skins'|'commands'|'health'|'git'|'memory'|'terminals'|'processes'|'config'} kind
+ * @param {'current-mission'|'monitor'|'field-report'|'checklist'|'more-sections'|'overview'|'plans'|'activity'|'agents'|'skills'|'skins'|'commands'|'health'|'git'|'devops'|'memory'|'terminals'|'processes'|'config'} kind
  * @param {{ decorative?: boolean }} [opts] decorative true (default): aria-hidden next to a visible label.
  *   decorative false: role=img + aria-label + title for icon-only controls (e.g. more-sections).
  */
@@ -6810,6 +7047,7 @@ function spaceIconSvg(kind, opts) {
     commands: 'Commands',
     health: 'Health',
     git: 'Git',
+    devops: 'DevOps',
     memory: 'Memory',
     terminals: 'Terminals',
     processes: 'Processes',
@@ -6877,6 +7115,12 @@ function spaceIconSvg(kind, opts) {
       '<path d="M10.5 4.5v7a2 2 0 01-2 2h-2"/>' +
       '<path d="M6.5 11.5a2 2 0 100-4 2 2 0 000 4z"/>' +
       '<path d="M10.5 6.5v2"/>',
+    // Linked nodes (devops) — two pipeline-stage circles joined by a short
+    // link; distinct from the Git branch glyph and from the Skills gear.
+    devops:
+      '<circle cx="5" cy="8" r="2.25"/>' +
+      '<circle cx="11" cy="8" r="2.25"/>' +
+      '<path d="M7.25 8h1.5"/>',
     // Chip (memory) — two internal lines 3 units apart; a third line would drop clearance below the stroke floor
     memory:
       '<path d="M4.5 2.5h7a1 1 0 011 1v9a1 1 0 01-1 1h-7a1 1 0 01-1-1v-9a1 1 0 011-1z"/>' +
@@ -7779,6 +8023,24 @@ function renderUnsafe() {
     gitDot.className = 'dot dot-green';
   }
 
+  // DevOps nav dot: state of the most recent pipeline run only (gray = no
+  // signal / gh unavailable, green = latest run succeeded, yellow = latest
+  // run in progress or non-success conclusion other than a hard failure,
+  // red = latest run failed/cancelled/timed out).
+  const devopsDot = document.getElementById('navDevopsDot');
+  const latestRun = (d.devops?.pipeline?.runs || [])[0] || null;
+  if (!latestRun) {
+    devopsDot.className = 'dot dot-gray';
+  } else if (latestRun.status !== 'completed') {
+    devopsDot.className = 'dot dot-yellow';
+  } else if (latestRun.conclusion === 'success') {
+    devopsDot.className = 'dot dot-green';
+  } else if (['failure', 'cancelled', 'timed_out'].includes(latestRun.conclusion)) {
+    devopsDot.className = 'dot dot-red';
+  } else {
+    devopsDot.className = 'dot dot-yellow';
+  }
+
   // Terminals / processes nav items carry count badges only (no decorative dots).
 
   // Build full HTML string once
@@ -8169,11 +8431,33 @@ function renderUnsafe() {
           </div>
         </div>
         ${renderGitGraphCard(d.git)}
+        ${renderGitVisualTree(d.git)}
         ${d.git?.dirty ? renderGitFileList(d.git) : ''}
       </div>
     </div>
   `);
 
+  // ===== DevOps =====
+  // Distinct scope from Processes (local-process-only): CI/CD pipeline status
+  // + a best-effort, honestly-scoped deploy-activity proxy. No fabricated
+  // "service health" widgets for infra this dashboard does not actually poll.
+  const devopsPipelineRuns = d.devops?.pipeline?.runs || [];
+  const devopsRunCount = devopsPipelineRuns.length;
+  parts.push(`
+    <div class="content-section" id="section-devops">
+      <div class="section-title">
+        DevOps
+        <span class="section-subtitle">${devopsRunCount} pipeline run${devopsRunCount !== 1 ? 's' : ''}</span>
+      </div>
+      <div class="card">
+        <div class="git-graph-title">CI/CD pipeline</div>
+        ${renderDevopsPipelineCard(d.devops)}
+        <div class="git-graph-title">Deploy activity</div>
+        ${renderDevopsDeployCard(d.devops)}
+      </div>
+    </div>
+  `);
+
   // ===== Memory =====
   const recentDecisions = d.memory?.recentDecisions || [];
   const recentErrors = d.memory?.recentErrors || [];