@evomap/evolver-webui 2.0.0-beta.1 → 2.0.0-beta.10

package/dist/server.js

@@ -1,22 +1,124 @@
 import { createServer } from 'node:http';
 import { randomBytes, timingSafeEqual } from 'node:crypto';
-import { events as ev, assetstore, mailbox as mb, ops } from '@evomap/evolver-core';
+import { events as ev, assetstore, mailbox as mb, ops, util } from '@evomap/evolver-core';
 import { CONSOLE_HTML } from './console.js';
+import { EventSnapshotCache, fileEventSnapshotSource } from './eventSnapshot.js';
+import { listLineageAssets, loadAssetLineage } from './assetLineage.js';
+import { eventListRelations } from './observabilityRelations.js';
+import { redactDiagnosticText, sanitizeDiagnosticValue } from './diagnosticSanitize.js';
 const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+const DASHBOARD_COOKIE = 'evolver_dashboard';
 /** The empty value summary (zero entries) — the shape /api/value returns when no provider is wired, so the card
  *  always gets a valid ValueSummary to render. Derived from core's aggregator to stay shape-identical. */
 const EMPTY_VALUE_SUMMARY = ops.valueSummary([]);
+const MEMORY_GRAPH_REASON_PATTERN = /scoped memory-graph outcome ([+-]\d+\.\d{3}) \(boost=([+-]?\d+\.\d{2})\)/;
+const MEMORY_GRAPH_RECOVERY_STATES = new Set(['healthy', 'degraded', 'recovered', 'empty']);
+function boundedMemoryGraphCount(value) {
+    const count = Number(value);
+    return Number.isFinite(count) && count > 0 ? Math.min(1_000_000, Math.floor(count)) : 0;
+}
+function sanitizeMemoryGraphReason(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const match = MEMORY_GRAPH_REASON_PATTERN.exec(value);
+    if (!match?.[1] || !match[2])
+        return undefined;
+    const outcome = Number(match[1]);
+    const boost = Number(match[2]);
+    if (!Number.isFinite(outcome) || !Number.isFinite(boost) || Math.abs(outcome) > 1 || Math.abs(boost) > 1)
+        return undefined;
+    return `scoped memory-graph outcome ${match[1]} (boost=${match[2]})`;
+}
+function sanitizeMemoryGraphStatus(value) {
+    const raw = value;
+    const recovery = MEMORY_GRAPH_RECOVERY_STATES.has(raw['recovery'])
+        ? raw['recovery']
+        : 'degraded';
+    const selectionReason = sanitizeMemoryGraphReason(raw['selectionReason']);
+    return {
+        recovery,
+        compactedRecords: boundedMemoryGraphCount(raw['compactedRecords']),
+        activeRecords: boundedMemoryGraphCount(raw['activeRecords']),
+        corruptLines: boundedMemoryGraphCount(raw['corruptLines']),
+        oversizedLines: boundedMemoryGraphCount(raw['oversizedLines']),
+        oversizedFiles: boundedMemoryGraphCount(raw['oversizedFiles']),
+        archives: boundedMemoryGraphCount(raw['archives']),
+        ...(selectionReason ? { selectionReason } : {}),
+    };
+}
 /** Constant-time token compare (avoids leaking the token via timing). */
 function tokenEq(a, b) {
     const ba = Buffer.from(a), bb = Buffer.from(b);
     return ba.length === bb.length && timingSafeEqual(ba, bb);
 }
+function cookieValue(header, name) {
+    for (const part of (header ?? '').split(';')) {
+        const at = part.indexOf('=');
+        if (at < 0 || part.slice(0, at).trim() !== name)
+            continue;
+        return part.slice(at + 1).trim();
+    }
+    return '';
+}
 function positiveIntParam(value) {
     if (value === null || value.trim() === '')
         return undefined;
     const n = Number(value);
     return Number.isFinite(n) && n > 0 ? Math.floor(n) : undefined;
 }
+function requireGet(req, res) {
+    if (req.method === 'GET')
+        return true;
+    res.writeHead(405, { allow: 'GET', 'content-type': 'application/json' });
+    res.end(JSON.stringify({ error: 'method_not_allowed' }));
+    return false;
+}
+const STABLE_WORKFLOW_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function boundedString(value, maxLength = 256) {
+    return typeof value === 'string' ? value.slice(0, maxLength) : '';
+}
+function safeRunSummary(value) {
+    const runId = boundedString(value.runId, 128);
+    const workflowId = boundedString(value.workflowId, 128);
+    if (!STABLE_WORKFLOW_ID.test(runId) || !STABLE_WORKFLOW_ID.test(workflowId))
+        return null;
+    const currentStep = value.currentStep === null ? null : boundedString(value.currentStep);
+    const completedAt = value.completedAt === null ? null : boundedString(value.completedAt, 64);
+    return {
+        runId,
+        workflowId,
+        status: boundedString(value.status, 64),
+        currentStep,
+        createdAt: boundedString(value.createdAt, 64),
+        updatedAt: boundedString(value.updatedAt, 64),
+        completedAt,
+    };
+}
+function safeHistoryEntry(value) {
+    if (!Number.isSafeInteger(value.sequence) || value.sequence < 0)
+        return null;
+    const optional = (candidate, maxLength = 256) => {
+        if (candidate === undefined)
+            return undefined;
+        if (candidate === null)
+            return null;
+        return boundedString(candidate, maxLength);
+    };
+    return {
+        sequence: value.sequence,
+        timestamp: boundedString(value.timestamp, 64),
+        type: boundedString(value.type, 128),
+        ...(value.status !== undefined ? { status: optional(value.status, 64) } : {}),
+        ...(value.stepId !== undefined ? { stepId: optional(value.stepId) } : {}),
+        ...(value.executionId !== undefined ? { executionId: optional(value.executionId) } : {}),
+        ...(value.gateId !== undefined ? { gateId: optional(value.gateId) } : {}),
+        ...(value.attempt !== undefined && (value.attempt === null || (Number.isSafeInteger(value.attempt) && value.attempt >= 0))
+            ? { attempt: value.attempt }
+            : {}),
+        ...(value.actorId !== undefined ? { actorId: optional(value.actorId, 128) } : {}),
+        ...(value.errorClass !== undefined ? { errorClass: optional(value.errorClass, 64) } : {}),
+    };
+}
 const HUMAN_ACTIONS = {
     observe: 'actor.human.observe', nudge: 'actor.human.nudge', intervene: 'actor.human.intervene', teach: 'actor.human.teach',
 };
@@ -33,62 +135,229 @@ export class WebUIServer {
     actorId;
     /** Review ledger backing the human-review queue. Undefined when no LocalJsonlProvider store is available. */
     review;
-    /** Token guarding /api/*; printed by the launcher, supplied by the browser via ?token= or Bearer. */
+    provenance;
+    /** Token guarding /api/*; supplied by the browser via Bearer, with ?token= retained for compatibility. */
     token;
+    launchTicket;
+    launchTicketAvailable = true;
+    eventSnapshots;
     constructor(deps) {
         this.deps = deps;
         this.host = deps.host ?? '127.0.0.1';
         this.now = deps.now ?? (() => Date.now());
         this.actorId = deps.actorId ?? 'console';
         this.token = deps.token ?? randomBytes(16).toString('hex');
+        this.launchTicket = deps.launchTicket ?? randomBytes(16).toString('hex');
+        this.eventSnapshots = new EventSnapshotCache(deps.eventSource ?? fileEventSnapshotSource(deps.eventsPath));
         this.ingestor = deps.ingestor ?? new ev.Ingestor({ path: deps.eventsPath });
         // Co-locate the review ledger with the store so the queue reads the same review.jsonl the CLI writes.
         this.review = deps.review ?? (deps.store instanceof assetstore.LocalJsonlProvider ? new assetstore.ReviewLedger(deps.store.baseDir) : undefined);
+        this.provenance = deps.provenance ?? (deps.store instanceof assetstore.LocalJsonlProvider ? new assetstore.ProvenanceStore(deps.store.baseDir) : undefined);
         this.server = createServer((req, res) => { void this.handle(req, res); });
     }
-    listen(port = 0) {
-        return new Promise((resolve) => this.server.listen(port, this.host, () => {
-            const a = this.server.address();
-            resolve(a && typeof a === 'object' ? a.port : port);
-        }));
+    async listen(port = 0) {
+        if (port !== 0 && util.isFetchForbiddenPort(port))
+            throw new Error('webui_port_blocked');
+        for (let attempt = 0; attempt < 5; attempt += 1) {
+            const assigned = await this.listenOnce(port);
+            if (port !== 0 || !util.isFetchForbiddenPort(assigned))
+                return assigned;
+            await this.close();
+        }
+        throw new Error('webui_safe_port_unavailable');
+    }
+    listenOnce(port) {
+        return new Promise((resolve, reject) => {
+            const onError = (error) => reject(error);
+            this.server.once('error', onError);
+            this.server.listen(port, this.host, () => {
+                this.server.removeListener('error', onError);
+                const a = this.server.address();
+                resolve(a && typeof a === 'object' ? a.port : port);
+            });
+        });
+    }
+    close() {
+        return new Promise((resolve, reject) => {
+            this.server.close((error) => (error ? reject(error) : resolve()));
+            this.server.closeAllConnections();
+        });
     }
-    close() { return new Promise((res, rej) => this.server.close((e) => (e ? rej(e) : res()))); }
     async handle(req, res) {
         try {
             if (!LOOPBACK.has(req.socket.remoteAddress ?? ''))
                 return this.send(res, 403, 'text/plain', 'non-loopback');
             const url = new URL(req.url ?? '/', 'http://localhost');
             const p = url.pathname;
+            if (p === '/launch') {
+                if (req.method !== 'GET') {
+                    res.writeHead(405, { allow: 'GET', 'content-type': 'text/plain' });
+                    res.end('method not allowed');
+                    return;
+                }
+                const ticket = url.searchParams.get('ticket') ?? '';
+                if (!this.launchTicketAvailable || !tokenEq(ticket, this.launchTicket)) {
+                    return this.send(res, 401, 'text/plain', 'unauthorized');
+                }
+                this.launchTicketAvailable = false;
+                res.writeHead(302, {
+                    location: '/',
+                    'set-cookie': `${DASHBOARD_COOKIE}=${this.token}; HttpOnly; SameSite=Strict; Path=/`,
+                    'cache-control': 'no-store',
+                    'referrer-policy': 'no-referrer',
+                });
+                res.end();
+                return;
+            }
             // Root HTML is a static shell (no data) → served freely; it reads ?token= and authenticates the /api calls.
             if (p === '/' || p === '/index.html')
                 return this.send(res, 200, 'text/html; charset=utf-8', CONSOLE_HTML);
             // Everything else (all /api/*) requires the token — accepted via Bearer header or ?token= (browser convenience).
             const auth = req.headers['authorization'] ?? '';
-            const supplied = auth.startsWith('Bearer ') ? auth.slice(7) : (url.searchParams.get('token') ?? '');
-            if (!tokenEq(supplied, this.token))
+            const bearer = auth.startsWith('Bearer ') ? auth.slice(7) : '';
+            const queryToken = url.searchParams.get('token') ?? '';
+            const cookieToken = cookieValue(req.headers.cookie, DASHBOARD_COOKIE);
+            const bearerValid = tokenEq(bearer, this.token);
+            const queryValid = tokenEq(queryToken, this.token);
+            const cookieValid = tokenEq(cookieToken, this.token);
+            if (!bearerValid && !queryValid && !cookieValid) {
                 return this.send(res, 401, 'application/json', JSON.stringify({ error: 'unauthorized' }));
+            }
+            const stateChanging = req.method !== 'GET' && req.method !== 'HEAD';
+            if (stateChanging && cookieValid && !bearerValid && !queryValid) {
+                const expectedOrigin = req.headers.host ? `http://${req.headers.host}` : '';
+                if (!expectedOrigin || req.headers.origin !== expectedOrigin) {
+                    return this.send(res, 403, 'application/json', JSON.stringify({ error: 'same_origin_required' }));
+                }
+                if (!(req.headers['content-type'] ?? '').toLowerCase().startsWith('application/json')) {
+                    return this.send(res, 415, 'application/json', JSON.stringify({ error: 'json_required' }));
+                }
+            }
             if (p === '/api/status')
-                return this.json(res, ev.statusReport(ev.readEvents(this.deps.eventsPath)));
+                return this.json(res, ev.statusReport(await this.eventSnapshots.read()));
             if (p === '/api/cycles')
-                return this.json(res, ev.listCycles(ev.readEvents(this.deps.eventsPath)));
-            if (p === '/api/cycle')
-                return this.json(res, ev.showCycle(ev.readEvents(this.deps.eventsPath), url.searchParams.get('id') ?? ''));
+                return this.json(res, ev.listCycles(await this.eventSnapshots.read()));
+            if (p === '/api/cycle') {
+                const cycle = ev.showCycle(await this.eventSnapshots.read(), url.searchParams.get('id') ?? '');
+                const safeTimeline = cycle.timeline.map((event) => ({
+                    ...event,
+                    title: redactDiagnosticText(event.title),
+                    ...(event.why ? { why: redactDiagnosticText(event.why) } : {}),
+                    ...(event.payload ? { payload: sanitizeDiagnosticValue(event.payload) } : {}),
+                }));
+                const relationEvents = cycle.timeline.map((event) => ({
+                    seq: event.seq, type: event.type, ts: event.ts, payload: event.payload,
+                    human: { title: event.title, ...(event.why ? { why: event.why } : {}) },
+                }));
+                return this.json(res, { ...cycle, timeline: safeTimeline, relations: eventListRelations(relationEvents) });
+            }
             if (p === '/api/narrative') {
-                return this.json(res, ev.buildNarrativeSnapshot(ev.readEvents(this.deps.eventsPath), { limit: positiveIntParam(url.searchParams.get('limit')) }));
+                return this.json(res, ev.buildNarrativeSnapshot(await this.eventSnapshots.read(), { limit: positiveIntParam(url.searchParams.get('limit')) }));
             }
             if (p === '/api/triggers')
-                return this.json(res, ev.listTriggers(ev.readEvents(this.deps.eventsPath)));
+                return this.json(res, ev.listTriggers(await this.eventSnapshots.read()));
             if (p === '/api/daily-summary') {
                 const day = url.searchParams.get('day') ?? new Date(this.now()).toISOString().slice(0, 10);
-                return this.json(res, ev.dailySummary(ev.readEvents(this.deps.eventsPath), day));
+                return this.json(res, ev.dailySummary(await this.eventSnapshots.read(), day));
             }
             if (p === '/api/value') {
                 // Thin pass-through: the provider (composition layer) owns prices + traces; the server only scopes the
                 // window and serializes. No provider wired → an empty summary so the card renders "no savings yet".
                 const window = ops.windowFromSpec(url.searchParams.get('window') ?? undefined, this.now());
-                const summary = this.deps.valueSummary ? this.deps.valueSummary(window) : EMPTY_VALUE_SUMMARY;
+                const summary = this.deps.valueSummary ? this.deps.valueSummary(window, await this.eventSnapshots.read()) : EMPTY_VALUE_SUMMARY;
                 return this.json(res, summary);
             }
+            if (p === '/api/personality') {
+                if (!requireGet(req, res))
+                    return;
+                return this.json(res, this.deps.personalityDiagnostics
+                    ? await this.deps.personalityDiagnostics()
+                    : { available: false, error: 'personality_unavailable' });
+            }
+            if (p === '/api/memory-graph') {
+                if (!requireGet(req, res))
+                    return;
+                if (!this.deps.memoryGraphStatus)
+                    return this.json(res, { available: false });
+                try {
+                    const status = sanitizeMemoryGraphStatus(this.deps.memoryGraphStatus());
+                    return this.json(res, { available: true, ...status });
+                }
+                catch {
+                    return this.send(res, 503, 'application/json', JSON.stringify({
+                        available: false,
+                        error: 'memory_graph_unavailable',
+                    }));
+                }
+            }
+            if (p === '/api/logs') {
+                if (!requireGet(req, res))
+                    return;
+                return this.json(res, this.deps.logDiagnostics
+                    ? await this.deps.logDiagnostics()
+                    : { available: false, error: 'logs_unavailable' });
+            }
+            if (p === '/api/github-prs') {
+                if (!requireGet(req, res))
+                    return;
+                return this.json(res, this.deps.githubPrDiagnostics
+                    ? await this.deps.githubPrDiagnostics()
+                    : { available: false, error: 'github_prs_unavailable' });
+            }
+            if (p === '/api/retention') {
+                if (!this.deps.retentionReport)
+                    return this.json(res, { available: false });
+                try {
+                    return this.json(res, { ...this.deps.retentionReport(), available: true });
+                }
+                catch {
+                    return this.send(res, 503, 'application/json', JSON.stringify({
+                        available: false,
+                        error: 'retention_unavailable',
+                    }));
+                }
+            }
+            if (p === '/api/workflows') {
+                if (req.method !== 'GET')
+                    return this.methodNotAllowed(res, 'GET');
+                if (!this.deps.workflow)
+                    return this.json(res, { workflows: [] });
+                try {
+                    const workflows = (await this.deps.workflow.listRuns())
+                        .map(safeRunSummary)
+                        .filter((run) => run !== null);
+                    return this.json(res, { workflows });
+                }
+                catch {
+                    return this.apiError(res, 503, 'workflow_unavailable');
+                }
+            }
+            if (p === '/api/workflow' || p === '/api/workflow/history') {
+                if (req.method !== 'GET')
+                    return this.methodNotAllowed(res, 'GET');
+                const runId = url.searchParams.get('id') ?? '';
+                if (!STABLE_WORKFLOW_ID.test(runId))
+                    return this.apiError(res, 400, 'invalid_workflow_id');
+                if (!this.deps.workflow)
+                    return this.apiError(res, 503, 'workflow_unavailable');
+                try {
+                    if (p === '/api/workflow') {
+                        const candidate = await this.deps.workflow.getRun(runId);
+                        const run = candidate === null ? null : safeRunSummary(candidate);
+                        return run ? this.json(res, { workflow: run }) : this.apiError(res, 404, 'workflow_not_found');
+                    }
+                    const history = await this.deps.workflow.getHistory(runId);
+                    if (history === null)
+                        return this.apiError(res, 404, 'workflow_not_found');
+                    return this.json(res, {
+                        runId,
+                        history: history.map(safeHistoryEntry).filter((entry) => entry !== null),
+                    });
+                }
+                catch {
+                    return this.apiError(res, 503, 'workflow_unavailable');
+                }
+            }
             if (p === '/api/mailbox') {
                 if (!this.deps.mailbox)
                     return this.json(res, { pending: 0, dlq: 0, messages: [] });
@@ -104,6 +373,31 @@ export class WebUIServer {
                 const kind = url.searchParams.get('kind');
                 return this.json(res, (await this.deps.store.list(kind ?? undefined, 100)).map((a) => ({ asset_id: a.asset_id, type: a.type, summary: a.summary })));
             }
+            if (p === '/api/asset-lineage/assets') {
+                if (!requireGet(req, res))
+                    return;
+                return this.json(res, await listLineageAssets(this.deps.store, {
+                    page: positiveIntParam(url.searchParams.get('page')),
+                    pageSize: positiveIntParam(url.searchParams.get('pageSize')),
+                }));
+            }
+            if (p === '/api/asset-lineage') {
+                if (!requireGet(req, res))
+                    return;
+                return this.json(res, await loadAssetLineage({
+                    store: this.deps.store,
+                    events: () => this.eventSnapshots.read(),
+                    review: this.review,
+                    provenance: this.provenance,
+                }, url.searchParams.get('id') ?? '', {
+                    page: positiveIntParam(url.searchParams.get('page')),
+                    pageSize: positiveIntParam(url.searchParams.get('pageSize')),
+                    capsulePage: positiveIntParam(url.searchParams.get('capsulePage')),
+                    capsulePageSize: positiveIntParam(url.searchParams.get('capsulePageSize')),
+                    eventPage: positiveIntParam(url.searchParams.get('eventPage')),
+                    eventPageSize: positiveIntParam(url.searchParams.get('eventPageSize')),
+                }));
+            }
             if (p === '/api/review' && req.method === 'POST') {
                 // Approve/reject a quarantined draft from the console: the SAME gate the CLI uses — flip the ReviewLedger
                 // state + record an audited actor.human.review.* event. Loopback + bearer already guard the route; actor is
@@ -143,7 +437,7 @@ export class WebUIServer {
                 // record) are appended as context from a bounded list. Pending (quarantined) sorts first. Read-only here.
                 // Match the CLI's semantics exactly: only the unattended distill-observer counts as "auto-drafted"
                 // (manual `ingest --distill` / skill2gep emit gene.distilled with a different source and are NOT auto).
-                const autoDrafted = new Set(this.ingestor.readAll()
+                const autoDrafted = new Set((await this.eventSnapshots.read())
                     .filter((e) => e.type === 'gene.distilled' && e.payload?.['source'] === 'distill-observer')
                     .map((e) => String(e.payload?.['assetId'] ?? ''))
                     .filter(Boolean));
@@ -178,8 +472,8 @@ export class WebUIServer {
             }
             return this.send(res, 404, 'application/json', JSON.stringify({ error: 'not found' }));
         }
-        catch (e) {
-            return this.send(res, 500, 'application/json', JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
+        catch {
+            return this.send(res, 500, 'application/json', JSON.stringify({ error: 'dashboard_request_failed' }));
         }
     }
     readJson(req) {
@@ -200,5 +494,10 @@ export class WebUIServer {
         });
     }
     json(res, body) { this.send(res, 200, 'application/json', JSON.stringify(body)); }
+    apiError(res, code, error) { this.send(res, code, 'application/json', JSON.stringify({ error })); }
+    methodNotAllowed(res, allow) {
+        res.writeHead(405, { allow, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'method_not_allowed' }));
+    }
     send(res, code, ct, body) { res.writeHead(code, { 'content-type': ct }); res.end(body); }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evomap/evolver-webui",
-  "version": "2.0.0-beta.1",
+  "version": "2.0.0-beta.10",
   "private": false,
   "type": "module",
   "description": "保活/可视化 WebUI",
@@ -13,7 +13,11 @@
     }
   },
   "dependencies": {
-    "@evomap/evolver-core": "2.0.0-beta.1"
+    "@evomap/evolver-core": "2.0.0-beta.10"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/EvoMap/evolver.git"
   },
   "publishConfig": {
     "access": "public",
@@ -21,6 +25,7 @@
   },
   "files": [
     "dist/",
+    "assets/",
     "README.md",
     "package.json"
   ]