@evomap/evolver-webui 2.0.0-beta.2 → 2.0.0-beta.22

package/dist/server.js

@@ -1,20 +1,51 @@
 import { createServer } from 'node:http';
 import { randomBytes, timingSafeEqual } from 'node:crypto';
-import { events as ev, assetstore, mailbox as mb, ops } from '@evomap/evolver-core';
+import { events as ev, assetstore, mailbox as mb, ops, util } from '@evomap/evolver-core';
 import { CONSOLE_HTML } from './console.js';
 import { EventSnapshotCache, fileEventSnapshotSource } from './eventSnapshot.js';
+import { listLineageAssets, loadAssetLineage } from './assetLineage.js';
+import { eventListRelations } from './observabilityRelations.js';
+import { redactDiagnosticText, sanitizeDiagnosticValue } from './diagnosticSanitize.js';
 const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
 const DASHBOARD_COOKIE = 'evolver_dashboard';
-const BROWSER_BLOCKED_PORTS = new Set([
-    1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42, 43, 53, 69, 77, 79, 87, 95,
-    101, 102, 103, 104, 109, 110, 111, 113, 115, 117, 119, 123, 135, 137, 139, 143, 161, 179,
-    389, 427, 465, 512, 513, 514, 515, 526, 530, 531, 532, 540, 548, 554, 556, 563, 587, 601,
-    636, 989, 990, 993, 995, 1719, 1720, 1723, 2049, 3659, 4045, 5060, 5061, 6000, 6566,
-    6665, 6666, 6667, 6668, 6669, 6697, 10080,
-]);
 /** The empty value summary (zero entries) — the shape /api/value returns when no provider is wired, so the card
  *  always gets a valid ValueSummary to render. Derived from core's aggregator to stay shape-identical. */
 const EMPTY_VALUE_SUMMARY = ops.valueSummary([]);
+const MEMORY_GRAPH_REASON_PATTERN = /scoped memory-graph outcome ([+-]\d+\.\d{3}) \(boost=([+-]?\d+\.\d{2})\)/;
+const MEMORY_GRAPH_RECOVERY_STATES = new Set(['healthy', 'degraded', 'recovered', 'empty']);
+function boundedMemoryGraphCount(value) {
+    const count = Number(value);
+    return Number.isFinite(count) && count > 0 ? Math.min(1_000_000, Math.floor(count)) : 0;
+}
+function sanitizeMemoryGraphReason(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const match = MEMORY_GRAPH_REASON_PATTERN.exec(value);
+    if (!match?.[1] || !match[2])
+        return undefined;
+    const outcome = Number(match[1]);
+    const boost = Number(match[2]);
+    if (!Number.isFinite(outcome) || !Number.isFinite(boost) || Math.abs(outcome) > 1 || Math.abs(boost) > 1)
+        return undefined;
+    return `scoped memory-graph outcome ${match[1]} (boost=${match[2]})`;
+}
+function sanitizeMemoryGraphStatus(value) {
+    const raw = value;
+    const recovery = MEMORY_GRAPH_RECOVERY_STATES.has(raw['recovery'])
+        ? raw['recovery']
+        : 'degraded';
+    const selectionReason = sanitizeMemoryGraphReason(raw['selectionReason']);
+    return {
+        recovery,
+        compactedRecords: boundedMemoryGraphCount(raw['compactedRecords']),
+        activeRecords: boundedMemoryGraphCount(raw['activeRecords']),
+        corruptLines: boundedMemoryGraphCount(raw['corruptLines']),
+        oversizedLines: boundedMemoryGraphCount(raw['oversizedLines']),
+        oversizedFiles: boundedMemoryGraphCount(raw['oversizedFiles']),
+        archives: boundedMemoryGraphCount(raw['archives']),
+        ...(selectionReason ? { selectionReason } : {}),
+    };
+}
 /** Constant-time token compare (avoids leaking the token via timing). */
 function tokenEq(a, b) {
     const ba = Buffer.from(a), bb = Buffer.from(b);
@@ -35,6 +66,59 @@ function positiveIntParam(value) {
     const n = Number(value);
     return Number.isFinite(n) && n > 0 ? Math.floor(n) : undefined;
 }
+function requireGet(req, res) {
+    if (req.method === 'GET')
+        return true;
+    res.writeHead(405, { allow: 'GET', 'content-type': 'application/json' });
+    res.end(JSON.stringify({ error: 'method_not_allowed' }));
+    return false;
+}
+const STABLE_WORKFLOW_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function boundedString(value, maxLength = 256) {
+    return typeof value === 'string' ? value.slice(0, maxLength) : '';
+}
+function safeRunSummary(value) {
+    const runId = boundedString(value.runId, 128);
+    const workflowId = boundedString(value.workflowId, 128);
+    if (!STABLE_WORKFLOW_ID.test(runId) || !STABLE_WORKFLOW_ID.test(workflowId))
+        return null;
+    const currentStep = value.currentStep === null ? null : boundedString(value.currentStep);
+    const completedAt = value.completedAt === null ? null : boundedString(value.completedAt, 64);
+    return {
+        runId,
+        workflowId,
+        status: boundedString(value.status, 64),
+        currentStep,
+        createdAt: boundedString(value.createdAt, 64),
+        updatedAt: boundedString(value.updatedAt, 64),
+        completedAt,
+    };
+}
+function safeHistoryEntry(value) {
+    if (!Number.isSafeInteger(value.sequence) || value.sequence < 0)
+        return null;
+    const optional = (candidate, maxLength = 256) => {
+        if (candidate === undefined)
+            return undefined;
+        if (candidate === null)
+            return null;
+        return boundedString(candidate, maxLength);
+    };
+    return {
+        sequence: value.sequence,
+        timestamp: boundedString(value.timestamp, 64),
+        type: boundedString(value.type, 128),
+        ...(value.status !== undefined ? { status: optional(value.status, 64) } : {}),
+        ...(value.stepId !== undefined ? { stepId: optional(value.stepId) } : {}),
+        ...(value.executionId !== undefined ? { executionId: optional(value.executionId) } : {}),
+        ...(value.gateId !== undefined ? { gateId: optional(value.gateId) } : {}),
+        ...(value.attempt !== undefined && (value.attempt === null || (Number.isSafeInteger(value.attempt) && value.attempt >= 0))
+            ? { attempt: value.attempt }
+            : {}),
+        ...(value.actorId !== undefined ? { actorId: optional(value.actorId, 128) } : {}),
+        ...(value.errorClass !== undefined ? { errorClass: optional(value.errorClass, 64) } : {}),
+    };
+}
 const HUMAN_ACTIONS = {
     observe: 'actor.human.observe', nudge: 'actor.human.nudge', intervene: 'actor.human.intervene', teach: 'actor.human.teach',
 };
@@ -51,6 +135,7 @@ export class WebUIServer {
     actorId;
     /** Review ledger backing the human-review queue. Undefined when no LocalJsonlProvider store is available. */
     review;
+    provenance;
     /** Token guarding /api/*; supplied by the browser via Bearer, with ?token= retained for compatibility. */
     token;
     launchTicket;
@@ -67,14 +152,15 @@ export class WebUIServer {
         this.ingestor = deps.ingestor ?? new ev.Ingestor({ path: deps.eventsPath });
         // Co-locate the review ledger with the store so the queue reads the same review.jsonl the CLI writes.
         this.review = deps.review ?? (deps.store instanceof assetstore.LocalJsonlProvider ? new assetstore.ReviewLedger(deps.store.baseDir) : undefined);
+        this.provenance = deps.provenance ?? (deps.store instanceof assetstore.LocalJsonlProvider ? new assetstore.ProvenanceStore(deps.store.baseDir) : undefined);
         this.server = createServer((req, res) => { void this.handle(req, res); });
     }
     async listen(port = 0) {
-        if (port !== 0 && BROWSER_BLOCKED_PORTS.has(port))
+        if (port !== 0 && util.isFetchForbiddenPort(port))
             throw new Error('webui_port_blocked');
         for (let attempt = 0; attempt < 5; attempt += 1) {
             const assigned = await this.listenOnce(port);
-            if (port !== 0 || !BROWSER_BLOCKED_PORTS.has(assigned))
+            if (port !== 0 || !util.isFetchForbiddenPort(assigned))
                 return assigned;
             await this.close();
         }
@@ -148,27 +234,109 @@ export class WebUIServer {
                 }
             }
             if (p === '/api/status')
-                return this.json(res, ev.statusReport(this.eventSnapshots.read()));
+                return this.json(res, ev.statusReport(await this.eventSnapshots.read()));
             if (p === '/api/cycles')
-                return this.json(res, ev.listCycles(this.eventSnapshots.read()));
-            if (p === '/api/cycle')
-                return this.json(res, ev.showCycle(this.eventSnapshots.read(), url.searchParams.get('id') ?? ''));
+                return this.json(res, ev.listCycles(await this.eventSnapshots.read()));
+            if (p === '/api/cycle') {
+                const cycle = ev.showCycle(await this.eventSnapshots.read(), url.searchParams.get('id') ?? '');
+                const safeTimeline = cycle.timeline.map((event) => ({
+                    ...event,
+                    title: redactDiagnosticText(event.title),
+                    ...(event.why ? { why: redactDiagnosticText(event.why) } : {}),
+                    ...(event.payload ? { payload: sanitizeDiagnosticValue(event.payload) } : {}),
+                }));
+                const relationEvents = cycle.timeline.map((event) => ({
+                    seq: event.seq, type: event.type, ts: event.ts, payload: event.payload,
+                    human: { title: event.title, ...(event.why ? { why: event.why } : {}) },
+                }));
+                return this.json(res, { ...cycle, timeline: safeTimeline, relations: eventListRelations(relationEvents) });
+            }
             if (p === '/api/narrative') {
-                return this.json(res, ev.buildNarrativeSnapshot(this.eventSnapshots.read(), { limit: positiveIntParam(url.searchParams.get('limit')) }));
+                return this.json(res, ev.buildNarrativeSnapshot(await this.eventSnapshots.read(), { limit: positiveIntParam(url.searchParams.get('limit')) }));
             }
             if (p === '/api/triggers')
-                return this.json(res, ev.listTriggers(this.eventSnapshots.read()));
+                return this.json(res, ev.listTriggers(await this.eventSnapshots.read()));
+            if (p === '/api/evolution-graph') {
+                // Read-only projection of the SAME event snapshot the other cards read. The WebUI never re-derives lineage:
+                // core owns the projector, the server only bounds the window and serializes the summary + edge list.
+                if (!requireGet(req, res))
+                    return;
+                try {
+                    const graph = ops.projectEvolutionGraph(await this.eventSnapshots.read(), {
+                        maxEvents: positiveIntParam(url.searchParams.get('maxEvents')),
+                    });
+                    return this.json(res, {
+                        available: true,
+                        graphId: graph.graphId,
+                        generatedAt: graph.generatedAt,
+                        dashboard: graph.dashboard,
+                        nodes: graph.nodes.map((node) => ({ id: node.id, kind: node.kind, label: redactDiagnosticText(node.label) })),
+                        edges: graph.edges.map((edge) => ({
+                            id: edge.id,
+                            kind: edge.kind,
+                            from: edge.from,
+                            to: edge.to,
+                            ...(edge.reason ? { reason: redactDiagnosticText(edge.reason) } : {}),
+                            ...(edge.metricDelta ? { metricDelta: edge.metricDelta } : {}),
+                            provenance: edge.provenance.map((entry) => ({ kind: entry.kind, ref: entry.ref })),
+                        })),
+                    });
+                }
+                catch {
+                    return this.send(res, 503, 'application/json', JSON.stringify({
+                        available: false,
+                        error: 'evolution_graph_unavailable',
+                    }));
+                }
+            }
             if (p === '/api/daily-summary') {
                 const day = url.searchParams.get('day') ?? new Date(this.now()).toISOString().slice(0, 10);
-                return this.json(res, ev.dailySummary(this.eventSnapshots.read(), day));
+                return this.json(res, ev.dailySummary(await this.eventSnapshots.read(), day));
             }
             if (p === '/api/value') {
                 // Thin pass-through: the provider (composition layer) owns prices + traces; the server only scopes the
                 // window and serializes. No provider wired → an empty summary so the card renders "no savings yet".
                 const window = ops.windowFromSpec(url.searchParams.get('window') ?? undefined, this.now());
-                const summary = this.deps.valueSummary ? this.deps.valueSummary(window, this.eventSnapshots.read()) : EMPTY_VALUE_SUMMARY;
+                const summary = this.deps.valueSummary ? this.deps.valueSummary(window, await this.eventSnapshots.read()) : EMPTY_VALUE_SUMMARY;
                 return this.json(res, summary);
             }
+            if (p === '/api/personality') {
+                if (!requireGet(req, res))
+                    return;
+                return this.json(res, this.deps.personalityDiagnostics
+                    ? await this.deps.personalityDiagnostics()
+                    : { available: false, error: 'personality_unavailable' });
+            }
+            if (p === '/api/memory-graph') {
+                if (!requireGet(req, res))
+                    return;
+                if (!this.deps.memoryGraphStatus)
+                    return this.json(res, { available: false });
+                try {
+                    const status = sanitizeMemoryGraphStatus(this.deps.memoryGraphStatus());
+                    return this.json(res, { available: true, ...status });
+                }
+                catch {
+                    return this.send(res, 503, 'application/json', JSON.stringify({
+                        available: false,
+                        error: 'memory_graph_unavailable',
+                    }));
+                }
+            }
+            if (p === '/api/logs') {
+                if (!requireGet(req, res))
+                    return;
+                return this.json(res, this.deps.logDiagnostics
+                    ? await this.deps.logDiagnostics()
+                    : { available: false, error: 'logs_unavailable' });
+            }
+            if (p === '/api/github-prs') {
+                if (!requireGet(req, res))
+                    return;
+                return this.json(res, this.deps.githubPrDiagnostics
+                    ? await this.deps.githubPrDiagnostics()
+                    : { available: false, error: 'github_prs_unavailable' });
+            }
             if (p === '/api/retention') {
                 if (!this.deps.retentionReport)
                     return this.json(res, { available: false });
@@ -182,6 +350,47 @@ export class WebUIServer {
                     }));
                 }
             }
+            if (p === '/api/workflows') {
+                if (req.method !== 'GET')
+                    return this.methodNotAllowed(res, 'GET');
+                if (!this.deps.workflow)
+                    return this.json(res, { workflows: [] });
+                try {
+                    const workflows = (await this.deps.workflow.listRuns())
+                        .map(safeRunSummary)
+                        .filter((run) => run !== null);
+                    return this.json(res, { workflows });
+                }
+                catch {
+                    return this.apiError(res, 503, 'workflow_unavailable');
+                }
+            }
+            if (p === '/api/workflow' || p === '/api/workflow/history') {
+                if (req.method !== 'GET')
+                    return this.methodNotAllowed(res, 'GET');
+                const runId = url.searchParams.get('id') ?? '';
+                if (!STABLE_WORKFLOW_ID.test(runId))
+                    return this.apiError(res, 400, 'invalid_workflow_id');
+                if (!this.deps.workflow)
+                    return this.apiError(res, 503, 'workflow_unavailable');
+                try {
+                    if (p === '/api/workflow') {
+                        const candidate = await this.deps.workflow.getRun(runId);
+                        const run = candidate === null ? null : safeRunSummary(candidate);
+                        return run ? this.json(res, { workflow: run }) : this.apiError(res, 404, 'workflow_not_found');
+                    }
+                    const history = await this.deps.workflow.getHistory(runId);
+                    if (history === null)
+                        return this.apiError(res, 404, 'workflow_not_found');
+                    return this.json(res, {
+                        runId,
+                        history: history.map(safeHistoryEntry).filter((entry) => entry !== null),
+                    });
+                }
+                catch {
+                    return this.apiError(res, 503, 'workflow_unavailable');
+                }
+            }
             if (p === '/api/mailbox') {
                 if (!this.deps.mailbox)
                     return this.json(res, { pending: 0, dlq: 0, messages: [] });
@@ -197,6 +406,31 @@ export class WebUIServer {
                 const kind = url.searchParams.get('kind');
                 return this.json(res, (await this.deps.store.list(kind ?? undefined, 100)).map((a) => ({ asset_id: a.asset_id, type: a.type, summary: a.summary })));
             }
+            if (p === '/api/asset-lineage/assets') {
+                if (!requireGet(req, res))
+                    return;
+                return this.json(res, await listLineageAssets(this.deps.store, {
+                    page: positiveIntParam(url.searchParams.get('page')),
+                    pageSize: positiveIntParam(url.searchParams.get('pageSize')),
+                }));
+            }
+            if (p === '/api/asset-lineage') {
+                if (!requireGet(req, res))
+                    return;
+                return this.json(res, await loadAssetLineage({
+                    store: this.deps.store,
+                    events: () => this.eventSnapshots.read(),
+                    review: this.review,
+                    provenance: this.provenance,
+                }, url.searchParams.get('id') ?? '', {
+                    page: positiveIntParam(url.searchParams.get('page')),
+                    pageSize: positiveIntParam(url.searchParams.get('pageSize')),
+                    capsulePage: positiveIntParam(url.searchParams.get('capsulePage')),
+                    capsulePageSize: positiveIntParam(url.searchParams.get('capsulePageSize')),
+                    eventPage: positiveIntParam(url.searchParams.get('eventPage')),
+                    eventPageSize: positiveIntParam(url.searchParams.get('eventPageSize')),
+                }));
+            }
             if (p === '/api/review' && req.method === 'POST') {
                 // Approve/reject a quarantined draft from the console: the SAME gate the CLI uses — flip the ReviewLedger
                 // state + record an audited actor.human.review.* event. Loopback + bearer already guard the route; actor is
@@ -236,7 +470,7 @@ export class WebUIServer {
                 // record) are appended as context from a bounded list. Pending (quarantined) sorts first. Read-only here.
                 // Match the CLI's semantics exactly: only the unattended distill-observer counts as "auto-drafted"
                 // (manual `ingest --distill` / skill2gep emit gene.distilled with a different source and are NOT auto).
-                const autoDrafted = new Set(this.eventSnapshots.read()
+                const autoDrafted = new Set((await this.eventSnapshots.read())
                     .filter((e) => e.type === 'gene.distilled' && e.payload?.['source'] === 'distill-observer')
                     .map((e) => String(e.payload?.['assetId'] ?? ''))
                     .filter(Boolean));
@@ -271,8 +505,8 @@ export class WebUIServer {
             }
             return this.send(res, 404, 'application/json', JSON.stringify({ error: 'not found' }));
         }
-        catch (e) {
-            return this.send(res, 500, 'application/json', JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
+        catch {
+            return this.send(res, 500, 'application/json', JSON.stringify({ error: 'dashboard_request_failed' }));
         }
     }
     readJson(req) {
@@ -293,5 +527,10 @@ export class WebUIServer {
         });
     }
     json(res, body) { this.send(res, 200, 'application/json', JSON.stringify(body)); }
+    apiError(res, code, error) { this.send(res, code, 'application/json', JSON.stringify({ error })); }
+    methodNotAllowed(res, allow) {
+        res.writeHead(405, { allow, 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'method_not_allowed' }));
+    }
     send(res, code, ct, body) { res.writeHead(code, { 'content-type': ct }); res.end(body); }
 }

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@evomap/evolver-webui",
-  "version": "2.0.0-beta.2",
+  "version": "2.0.0-beta.22",
   "private": false,
   "type": "module",
+  "engines": {
+    "node": "^22.13.0 || >=23.4.0"
+  },
   "description": "保活/可视化 WebUI",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -13,7 +16,12 @@
     }
   },
   "dependencies": {
-    "@evomap/evolver-core": "2.0.0-beta.2"
+    "@evomap/evolver-core": "2.0.0-beta.22",
+    "jsonc-parser": "3.3.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/EvoMap/evolver.git"
   },
   "publishConfig": {
     "access": "public",