@hanzlaa/rcode 4.12.1 → 4.14.0

package/server/lib/html/client/orchestrator.js

@@ -14,18 +14,40 @@ import { getState, setState } from './store.js';
 import { showToast } from './components/shared.js';
 import { trackBlocked } from './notify.js';
 
-// #969 — the orchestrator port is injected by the server (see shell.js) as
-// window.__ORCH_PORT__, since a dashboard started with ORCH_PORT set (e.g. a
-// second instance under test) spawns its orchestrator on a non-default port.
-// A hardcoded 7718 here would silently drive the wrong orchestrator process.
+// #969 / #1037 — the orchestrator port is injected by the server (see
+// shell.js) as window.__ORCH_PORT__, since a dashboard started with
+// ORCH_PORT set (e.g. a second instance under test) spawns its orchestrator
+// on a non-default port. window.__ORCH_PORT__ is null when THIS dashboard's
+// orchestrator never bound — a hardcoded fallback (e.g. 7718) here would
+// silently drive some OTHER project's orchestrator, which is the exact bug
+// #1037 fixes server-side. So there is no fallback: null stays null, and
+// callers must check isOrchAvailable() before using orchHttp()/orchWs().
 // Resolved per-call (not cached at module load) so it works even if a caller
 // loads this module before the inline bootstrap script has run.
 function orchPort() {
-  return (typeof window !== 'undefined' && window.__ORCH_PORT__) || 7718;
+  return (typeof window !== 'undefined' && window.__ORCH_PORT__) || null;
 }
 
-export function orchHttp() { return 'http://localhost:' + orchPort(); }
-export function orchWs()   { return 'ws://localhost:' + orchPort(); }
+/** True when this dashboard has a live orchestrator to talk to. */
+export function isOrchAvailable() { return orchPort() != null; }
+
+/** The project root this dashboard is scanning — sent on every orchestrator
+ * request so the orchestrator can reject a mismatched-project caller (#1037). */
+export function projectRoot() {
+  return (typeof window !== 'undefined' && window.__PROJECT_ROOT__) || '';
+}
+
+export function orchHttp() { return isOrchAvailable() ? 'http://localhost:' + orchPort() : null; }
+export function orchWs()   { return isOrchAvailable() ? 'ws://localhost:' + orchPort()   : null; }
+
+// #967 — view-only mode, injected by shell.js from the server-side
+// dashboard.view_only config check (see server/lib/view-only.js). This gate
+// is UI convenience only: the orchestrator refuses POST /api/run itself
+// regardless of what the client sends, so a stale/bypassed client can't
+// actually spawn an agent — it just gets a clearer message here first.
+export function isViewOnly() {
+  return typeof window !== 'undefined' && !!window.__VIEW_ONLY__;
+}
 
 // ── Token helpers ─────────────────────────────────────────────────────────────
 
@@ -42,8 +64,13 @@ export function refreshOrchToken() {
   return fetch('/api/orch-token')
     .then(r => r.json())
     .then(d => {
-      if (d && d.token) window.__ORCH_TOKEN__ = d.token;
-      if (d && d.orchPort) window.__ORCH_PORT__ = d.orchPort;
+      if (!d) return;
+      if (d.token) window.__ORCH_TOKEN__ = d.token;
+      // #1037 — orchPort may legitimately have GONE null (orchestrator died
+      // or never started) since the page loaded, so this must not only ever
+      // set a truthy value — a stale truthy value must be cleared too.
+      window.__ORCH_PORT__ = d.orchPort || null;
+      if (d.projectRoot) window.__PROJECT_ROOT__ = d.projectRoot;
     })
     .catch(() => {});
 }
@@ -57,6 +84,7 @@ export function refreshOrchToken() {
  * Returns the parsed JSON response (or throws on network error).
  */
 export function runSession(storyId, cmd, opts) {
+  if (!isOrchAvailable()) return Promise.resolve({ error: 'orchestrator unavailable' });
   const tok  = orchToken();
   const body = { storyId, cmd };
   if (opts && opts.runner) {
@@ -65,7 +93,7 @@ export function runSession(storyId, cmd, opts) {
   }
   return fetch(orchHttp() + '/api/run', {
     method: 'POST',
-    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json' },
+    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json', 'X-Project-Root': projectRoot() },
     body: JSON.stringify(body),
   }).then(r => r.json());
 }
@@ -79,9 +107,10 @@ export function runSession(storyId, cmd, opts) {
 let _runnersPromise = null;
 export function fetchRunners() {
   if (_runnersPromise) return _runnersPromise;
+  if (!isOrchAvailable()) return Promise.resolve([]);
   const tok = orchToken();
   _runnersPromise = fetch(orchHttp() + '/api/runners', {
-    headers: { 'Authorization': 'Bearer ' + tok },
+    headers: { 'Authorization': 'Bearer ' + tok, 'X-Project-Root': projectRoot() },
   })
     .then(r => r.json())
     .then(d => (d && d.runners) || [])
@@ -93,10 +122,11 @@ export function fetchRunners() {
  * POST /api/stop — stop a running session.
  */
 export function stopSession(storyId) {
+  if (!isOrchAvailable()) return Promise.resolve();
   const tok = orchToken();
   return fetch(orchHttp() + '/api/stop', {
     method: 'POST',
-    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json' },
+    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json', 'X-Project-Root': projectRoot() },
     body: JSON.stringify({ storyId }),
   }).catch(() => {});
 }
@@ -108,9 +138,9 @@ export function stopSession(storyId) {
  */
 function fetchSessionsWithStatus() {
   const tok = orchToken();
-  if (!tok) return Promise.resolve({ ok: false, sessions: [] });
+  if (!tok || !isOrchAvailable()) return Promise.resolve({ ok: false, sessions: [] });
   return fetch(orchHttp() + '/api/sessions', {
-    headers: { 'Authorization': 'Bearer ' + tok },
+    headers: { 'Authorization': 'Bearer ' + tok, 'X-Project-Root': projectRoot() },
   })
     .then(r => {
       if (r.status === 401) { refreshOrchToken(); return { ok: true, sessions: [] }; }
@@ -131,8 +161,8 @@ export function fetchSessions() {
  */
 export function fetchHistory() {
   const tok = orchToken();
-  if (!tok) return Promise.resolve([]);
-  return fetch(orchHttp() + '/api/history', { headers: { 'Authorization': 'Bearer ' + tok } })
+  if (!tok || !isOrchAvailable()) return Promise.resolve([]);
+  return fetch(orchHttp() + '/api/history', { headers: { 'Authorization': 'Bearer ' + tok, 'X-Project-Root': projectRoot() } })
     .then(r => {
       if (r.status === 401) { refreshOrchToken(); return []; }
       return r.json().then(d => (d && d.history) || []);
@@ -172,10 +202,11 @@ export function isOrchOnline() {
  * phase is optional. Returns the parsed JSON response.
  */
 export function submitRejection(storyId, reason, phase) {
+  if (!isOrchAvailable()) return Promise.resolve({ error: 'orchestrator unavailable' });
   const tok = orchToken();
   return fetch(orchHttp() + '/api/reject', {
     method: 'POST',
-    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json' },
+    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json', 'X-Project-Root': projectRoot() },
     body: JSON.stringify({ storyId, reason, phase: phase || null }),
   }).then(r => r.json());
 }
@@ -185,8 +216,8 @@ export function submitRejection(storyId, reason, phase) {
  */
 export function fetchRejections() {
   const tok = orchToken();
-  if (!tok) return Promise.resolve([]);
-  return fetch(orchHttp() + '/api/rejections', { headers: { 'Authorization': 'Bearer ' + tok } })
+  if (!tok || !isOrchAvailable()) return Promise.resolve([]);
+  return fetch(orchHttp() + '/api/rejections', { headers: { 'Authorization': 'Bearer ' + tok, 'X-Project-Root': projectRoot() } })
     .then(r => r.ok ? r.json().then(d => (d && d.rejections) || []) : [])
     .catch(() => []);
 }
@@ -196,10 +227,11 @@ export function fetchRejections() {
  * status is the target column id (todo | in_progress | blocked | done).
  */
 export function setTaskStatus(storyId, status) {
+  if (!isOrchAvailable()) return Promise.resolve({});
   const tok = orchToken();
   return fetch(orchHttp() + '/api/task-status', {
     method: 'POST',
-    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json' },
+    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json', 'X-Project-Root': projectRoot() },
     body: JSON.stringify({ storyId, status }),
   }).then(r => r.json()).catch(() => ({}));
 }
@@ -209,10 +241,12 @@ export function setTaskStatus(storyId, status) {
  * olderThanDays = 0 removes all ended sessions; > 0 keeps recent ones.
  */
 export function cleanSessions(olderThanDays = 0) {
+  if (!isOrchAvailable()) return Promise.resolve({ removed: 0 });
+  if (isViewOnly()) { showToast('View-only mode — clean is disabled'); return Promise.resolve({ removed: 0 }); }
   const tok = orchToken();
   return fetch(orchHttp() + '/api/clean-sessions', {
     method: 'POST',
-    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json' },
+    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json', 'X-Project-Root': projectRoot() },
     body: JSON.stringify({ olderThanDays }),
   })
     .then(r => r.json())
@@ -316,6 +350,7 @@ function _poll() {
  * @param {{ runner?: string, model?: string }} [opts] — agent CLI selection
  */
 export function runAndOpenTerm(storyId, cmd, title, opts) {
+  if (isViewOnly()) { showToast('View-only mode — runs are disabled'); return; }
   // #916 — spawning an orchestrator session launches a real agent with
   // permissions skipped. Gate it behind an explicit confirmation dialog
   // instead of running on the first click. The dialog calls execRunAndOpenTerm
@@ -381,6 +416,7 @@ export function openOrchPanel(storyId) {
  * stopStory — Kanban "Stop" action.
  */
 export function stopStory(storyId) {
+  if (isViewOnly()) { showToast('View-only mode — stop is disabled'); return; }
   stopSession(storyId).catch(err => console.error('[orchestrator] session op failed:', err.message));
 }
 
@@ -432,6 +468,7 @@ export const ALLOWED_COMMANDS = [
  */
 export function runCommandFromUI(cmd, opts) {
   if (!cmd) return;
+  if (isViewOnly()) { showToast('View-only mode — runs are disabled'); return; }
   // #916 — gate command-runner spawns behind the same confirmation dialog.
   const title = cmd + ' (command runner)';
   setState({

package/server/lib/html/client/views/MemoryView.js

@@ -43,6 +43,13 @@ function CmdAccordion({ hints }) {
   `;
 }
 
+// ---- Age pill (#968) — fresh / aging / stale by mtime ----
+function AgePill({ ageDays, ageBand }) {
+  if (ageBand == null || ageDays == null) return null;
+  const label = ageDays === 0 ? 'updated today' : `updated ${ageDays}d ago`;
+  return html`<span class=${'memory-age-pill ' + ageBand}>${label}</span>`;
+}
+
 // ---- Section file list ----
 function SectionGroup({ section, files, onOpen }) {
   return html`
@@ -59,7 +66,10 @@ function SectionGroup({ section, files, onOpen }) {
               key=${f.name}
               onClick=${f.exists ? () => onOpen(f) : undefined}
             >
-              <div class="item-title">${status} ${f.name}</div>
+              <div class="item-title">
+                ${status} ${f.name}
+                <${AgePill} ageDays=${f.ageDays} ageBand=${f.ageBand} />
+              </div>
               <div class="item-meta">${meta} · ${f.bytes || 0} bytes</div>
             </div>
           `;
@@ -69,7 +79,7 @@ function SectionGroup({ section, files, onOpen }) {
   `;
 }
 
-// ---- Generic list group (distillates, change records, etc.) ----
+// ---- Generic list group (change records, archive, post-mortems) ----
 function ListGroup({ label, items, onOpen }) {
   if (!items || !items.length) return null;
   return html`
@@ -86,6 +96,51 @@ function ListGroup({ label, items, onOpen }) {
   `;
 }
 
+// ---- Distillates — freshness vs their source files (#968) ----
+function DistillateGroup({ items, onOpen }) {
+  if (!items || !items.length) return null;
+  return html`
+    <div>
+      <div class="memory-group-header">Distillates (${items.length})</div>
+      <div class="decision-list">
+        ${items.map(d => html`
+          <div class="item item-clickable" key=${d.name} onClick=${() => onOpen(d)}>
+            <div class="item-title">
+              ${d.name}
+              <${AgePill} ageDays=${d.ageDays} ageBand=${d.ageBand} />
+              ${d.stale ? html`<span class="memory-age-pill stale">source changed since generation</span>` : null}
+            </div>
+            <div class="item-meta">
+              ${d.generatedAt ? `generated ${d.generatedAt}` : 'no generated-at recorded'}
+              ${d.sourceDigest ? ` · digest ${d.sourceDigest.slice(0, 10)}…` : ''}
+              ${d.staleSources && d.staleSources.length ? ` · changed: ${d.staleSources.join(', ')}` : ''}
+              ${d.missingSources && d.missingSources.length ? ` · missing: ${d.missingSources.join(', ')}` : ''}
+            </div>
+          </div>
+        `)}
+      </div>
+    </div>
+  `;
+}
+
+// ---- Drift — same heuristics as `rcode-hooks drift` (#968) ----
+function DriftSection({ drift }) {
+  const drifts = (drift && drift.drifts) || [];
+  if (!drifts.length) return null;
+  return html`
+    <div>
+      <div class="memory-group-header">⚠ Drift (${drifts.length})</div>
+      ${drifts.map((d, i) => html`
+        <div class="memory-drift-item" key=${d.kind + '-' + i}>
+          <div class="memory-drift-kind">${d.kind}</div>
+          <div class="memory-drift-claim">${d.claim}</div>
+          <div class="memory-drift-evidence">${d.evidence}</div>
+        </div>
+      `)}
+    </div>
+  `;
+}
+
 // ---- Root MemoryView ----
 export function MemoryView() {
   const [memory, setMemory]   = useState(null);
@@ -154,10 +209,11 @@ export function MemoryView() {
         <span style="color:var(--text-muted);font-size:var(--text-sm);">Last scanned: ${memory.lastScanned || '—'}</span>
       </div>
       <div id="memory-sections">
+        <${DriftSection} drift=${memory.drift} />
         ${Object.entries(sections).map(([section, files]) => html`
           <${SectionGroup} key=${section} section=${section} files=${files} onOpen=${setReader} />
         `)}
-        <${ListGroup} label="Distillates" items=${memory.distillates} onOpen=${setReader} />
+        <${DistillateGroup} items=${memory.distillates} onOpen=${setReader} />
         <${ListGroup} label="Change Records" items=${memory.changeRecords} onOpen=${setReader} />
         <${ListGroup} label="Milestone Archive" items=${memory.archive} onOpen=${setReader} />
         <${ListGroup} label="Post-mortems" items=${memory.postMortems} onOpen=${setReader} />

package/server/lib/html/css.js

@@ -958,6 +958,46 @@ section .body {
   letter-spacing: -0.006em;
 }
 
+/* ── Memory freshness / drift (#968) ───────────────────────────────── */
+.memory-age-pill {
+  display: inline-flex;
+  align-items: center;
+  height: 16px;
+  padding: 0 6px;
+  border-radius: var(--radius-2);
+  font-size: var(--text-2xs);
+  font-weight: 600;
+  border: 1px solid transparent;
+}
+.memory-age-pill.fresh { color: var(--green); background: color-mix(in srgb, var(--green) 14%, transparent); border-color: color-mix(in srgb, var(--green) 30%, transparent); }
+.memory-age-pill.aging { color: var(--amber); background: color-mix(in srgb, var(--amber) 14%, transparent); border-color: color-mix(in srgb, var(--amber) 30%, transparent); }
+.memory-age-pill.stale { color: var(--red); background: color-mix(in srgb, var(--red) 14%, transparent); border-color: color-mix(in srgb, var(--red) 30%, transparent); }
+
+.memory-drift-item {
+  border-left: 2px solid var(--red);
+  padding: var(--space-2) var(--space-3);
+  margin: var(--space-2) 0;
+  background: var(--bg-elev-2);
+  border-radius: 0 var(--radius-2) var(--radius-2) 0;
+}
+.memory-drift-kind {
+  font-size: var(--text-2xs);
+  font-weight: 700;
+  color: var(--red);
+  text-transform: uppercase;
+  letter-spacing: 0.02em;
+}
+.memory-drift-claim {
+  font-size: var(--text-xs);
+  color: var(--text-primary);
+  margin-top: 2px;
+}
+.memory-drift-evidence {
+  font-size: var(--text-2xs);
+  color: var(--text-muted);
+  margin-top: 2px;
+}
+
 /* ── Markdown render ────────────────────────────────────────────── */
 .md-render {
   font-size: var(--text-xs);

package/server/lib/html/shell.js

@@ -6,14 +6,20 @@ const { renderClientJs } = require('./client');
 
 function esc(s) { return String(s || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;'); }
 
-function renderHtml(state, orchToken, orchPort) {
+function renderHtml(state, orchToken, orchPort, projectRoot, viewOnly) {
   const projectName = state.projectName || 'No project initialized';
   // #969 — the client used to hardcode port 7718 for the orchestrator API.
   // A dashboard started with ORCH_PORT set (e.g. to test in isolation from a
   // production instance) would silently talk to the wrong orchestrator. The
   // actual port is injected here — both into the CSP connect-src allowlist
   // and into window.__ORCH_PORT__ for orchestrator.js to read at runtime.
-  const port = parseInt(orchPort, 10) || 7718;
+  //
+  // #1037 — orchPort is null when this dashboard's orchestrator never bound
+  // (spawn failed, or its own free-port scan was exhausted). NEVER fall back
+  // to a constant like 7718 here — that port may belong to another project's
+  // orchestrator, and this dashboard did not spawn it. null stays null.
+  const port = orchPort == null ? null : (parseInt(orchPort, 10) || null);
+  const connectSrc = port ? ` http://localhost:${port} http://127.0.0.1:${port}` : '';
 
   // Agent roster moved to server/lib/html/client/agents-data.js (Sprint 31.3).
   // AgentsView.js renders it client-side; shell.js no longer needs it.
@@ -23,7 +29,7 @@ function renderHtml(state, orchToken, orchPort) {
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data:; connect-src 'self' http://localhost:${port} http://127.0.0.1:${port} ws: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'">
+<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data:; connect-src 'self'${connectSrc} ws: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'">
 <meta http-equiv="X-Content-Type-Options" content="nosniff">
 <meta name="referrer" content="strict-origin-when-cross-origin">
 <title>Majlis — ${esc(projectName)}</title>
@@ -32,7 +38,7 @@ function renderHtml(state, orchToken, orchPort) {
 <script src="https://cdn.jsdelivr.net/npm/marked@18.0.4/lib/marked.umd.js" integrity="sha384-8RA8Ah4c9upJmKfg5nH01OgjZoQ3mRX+ngrKYWXQYj2dHYxFqYz8POSlii33f0wB" crossorigin="anonymous"><\/script>
 <script src="https://cdn.jsdelivr.net/npm/xterm@5.3.0/lib/xterm.js" integrity="sha384-/nfmYPUzWMS6v2atn8hbljz7NE0EI1iGx34lJaNzyVjWGDzMv+ciUZUeJpKA3Glc" crossorigin="anonymous"><\/script>
 <script src="https://cdn.jsdelivr.net/npm/xterm-addon-fit@0.8.0/lib/xterm-addon-fit.js" integrity="sha384-AQLWHRKAgdTxkolJcLOELg4E9rE89CPE2xMy3tIRFn08NcGKPTsELdvKomqji+DL" crossorigin="anonymous"><\/script>
-<script>window.__ORCH_TOKEN__ = ${JSON.stringify(orchToken || '')}; window.__ORCH_PORT__ = ${port};<\/script>
+<script>window.__ORCH_TOKEN__ = ${JSON.stringify(orchToken || '')}; window.__ORCH_PORT__ = ${port === null ? 'null' : port}; window.__PROJECT_ROOT__ = ${JSON.stringify(projectRoot || '')}; window.__VIEW_ONLY__ = ${JSON.stringify(!!viewOnly)};<\/script>
 ${renderCss()}
 </head>
 <body>

package/server/lib/scanner.js

@@ -3,6 +3,7 @@
  */
 const fs = require('fs');
 const path = require('path');
+const { execSync } = require('child_process');
 
 function safeReadJson(filepath) {
   let raw;
@@ -712,13 +713,127 @@ function scanState(rcodeDir) {
   return state;
 }
 
+// Age-band thresholds (#968) — a memory file untouched this long has likely
+// drifted from the codebase it describes. Matches the incident report's own
+// "hasn't been updated in 2.5 months" framing: amber warns before red alarms.
+const AGE_BAND_AMBER_DAYS = 30;
+const AGE_BAND_RED_DAYS = 90;
+
+function ageDaysFromMtime(mtimeMs) {
+  return Math.floor((Date.now() - mtimeMs) / 86400000);
+}
+
+/** 'fresh' | 'aging' | 'stale', or null when age is unknown (file missing). */
+function ageBand(ageDays) {
+  if (ageDays == null) return null;
+  if (ageDays > AGE_BAND_RED_DAYS) return 'stale';
+  if (ageDays > AGE_BAND_AMBER_DAYS) return 'aging';
+  return 'fresh';
+}
+
+/**
+ * Read one frontmatter scalar by key. Distillate frontmatter uses hyphenated
+ * keys (source-digest, generated-at) that parseSimpleYaml's identifier-only
+ * key pattern does not match, so this is a small standalone reader scoped to
+ * the distillate use case rather than a change to the shared parser.
+ */
+function extractFrontmatterValue(frontmatterText, key) {
+  const m = frontmatterText.match(new RegExp('^' + key + '\\s*:\\s*(.+)$', 'm'));
+  return m ? m[1].trim().replace(/^['"]|['"]$/g, '') : null;
+}
+
+/**
+ * Last-commit timestamp for a repo-relative path, or null when git is
+ * unavailable / the path has no history (untracked, shallow clone). Used in
+ * preference to fs mtime for staleness comparisons: a fresh `git clone` or
+ * `git worktree add` stamps every checked-out file with the checkout time,
+ * which would make every distillate look freshly-edited relative to its
+ * (much older) generated-at — git's own commit history isn't affected by that.
+ */
+function gitLastCommitMs(projectRoot, repoRelPath) {
+  let out;
+  try {
+    out = execSync(`git log -1 --format=%cI -- ${JSON.stringify(repoRelPath)}`, {
+      cwd: projectRoot,
+      encoding: 'utf8',
+      timeout: 3000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch {
+    return null;
+  }
+  if (!out) return null;
+  const ms = Date.parse(out);
+  return Number.isFinite(ms) ? ms : null;
+}
+
+/**
+ * Distillates carry `source-digest` / `generated-at` / `source-files` in
+ * their frontmatter (see rcode/workflows/memory-distill.md), but the digest
+ * is produced by an LLM-run workflow step with no deterministic script in
+ * this repo to reproduce it byte-for-byte — recomputing and diffing it here
+ * would just be a guess dressed up as a check. What IS verifiable: whether
+ * any source file has changed (by git commit history, not fs mtime — see
+ * gitLastCommitMs) more recently than the distillate claims to have been
+ * generated. That's the real signal "is this distillate stale" is asking
+ * for, so that's what drives `stale` — `sourceDigest` is still surfaced
+ * as-is for reference.
+ */
+function scanDistillateFreshness(memoryDir, projectRoot, subdir, entry) {
+  const full = path.join(memoryDir, subdir, entry.name);
+  let distillateMtimeMs = null;
+  try { distillateMtimeMs = fs.statSync(full).mtimeMs; } catch { /* unreadable — leave null */ }
+
+  const text = safeReadText(full) || '';
+  const fmEnd = text.startsWith('---') ? text.indexOf('\n---', 3) : -1;
+  const frontmatter = fmEnd !== -1 ? text.slice(0, fmEnd) : '';
+
+  const sourceDigest = extractFrontmatterValue(frontmatter, 'source-digest');
+  const generatedAt = extractFrontmatterValue(frontmatter, 'generated-at');
+  const sourceFiles = parseYamlList(frontmatter, 'source-files');
+
+  // Anchor staleness to generated-at when it parses (explicit "as-of" claim);
+  // fall back to the distillate file's own mtime otherwise.
+  const generatedAtMs = generatedAt ? Date.parse(generatedAt) : NaN;
+  const anchorMs = Number.isFinite(generatedAtMs) ? generatedAtMs : distillateMtimeMs;
+
+  const staleSources = [];
+  const missingSources = [];
+  for (const rel of sourceFiles) {
+    const srcFull = path.join(memoryDir, rel);
+    if (!fs.existsSync(srcFull)) { missingSources.push(rel); continue; }
+    const repoRelPath = path.relative(projectRoot, srcFull);
+    let changedMs = gitLastCommitMs(projectRoot, repoRelPath);
+    if (changedMs == null) {
+      try { changedMs = fs.statSync(srcFull).mtimeMs; } catch { changedMs = null; }
+    }
+    if (anchorMs != null && changedMs != null && changedMs > anchorMs) staleSources.push(rel);
+  }
+
+  const ageDays = distillateMtimeMs != null ? ageDaysFromMtime(distillateMtimeMs) : null;
+
+  return {
+    name: entry.name,
+    path: entry.path,
+    sourceDigest,
+    generatedAt,
+    sourceFiles,
+    ageDays,
+    ageBand: ageBand(ageDays),
+    staleSources,
+    missingSources,
+    stale: staleSources.length > 0 || missingSources.length > 0,
+  };
+}
+
 /**
  * Scan the Memory Bank at .rcode/memory/. Returns structure suitable
  * for the /api/memory endpoint and the dashboard /memory view.
  * Returns { exists: false } when the Memory Bank has not been initialised.
  */
-function scanMemoryBank(rcodeDir) {
+function scanMemoryBankUncached(rcodeDir) {
   const memoryDir = path.join(rcodeDir, 'memory');
+  const projectRoot = path.dirname(rcodeDir);
   const result = {
     exists: false,
     initialised: false,
@@ -728,6 +843,7 @@ function scanMemoryBank(rcodeDir) {
     changeRecords: [],
     archive: [],
     postMortems: [],
+    drift: { drifts: [], error: null },
     lastScanned: new Date().toISOString(),
   };
 
@@ -752,11 +868,12 @@ function scanMemoryBank(rcodeDir) {
     result.sections[section] = files.map(name => {
       const full = path.join(sectionDir, name);
       const exists = fs.existsSync(full);
-      let bytes = 0, populated = false;
+      let bytes = 0, populated = false, ageDays = null;
       if (exists) {
         try {
           const stat = fs.statSync(full);
           bytes = stat.size;
+          ageDays = ageDaysFromMtime(stat.mtimeMs);
           const text = fs.readFileSync(full, 'utf8');
           populated = !/\{\{[A-Z_]+\}\}/.test(text) && !/_\(e\.g\.\s/.test(text);
         } catch { /* ignore */ }
@@ -767,6 +884,8 @@ function scanMemoryBank(rcodeDir) {
         exists,
         bytes,
         populated,
+        ageDays,
+        ageBand: exists ? ageBand(ageDays) : null,
       };
     });
   }
@@ -779,11 +898,39 @@ function scanMemoryBank(rcodeDir) {
       .map(e => ({ name: e.name, path: `.rcode/memory/${subdir}/${e.name}` }));
   }
 
-  result.distillates = listMd('distillates');
+  result.distillates = listMd('distillates')
+    .map(entry => scanDistillateFreshness(memoryDir, projectRoot, 'distillates', entry));
   result.changeRecords = listMd('change-records');
   result.archive = listMd('milestones/archive');
   result.postMortems = listMd('incidents/post-mortems');
 
+  // #968 — same heuristics as `rcode-hooks drift` (rcode/bin/lib/memory-drift.cjs):
+  // dependency contradictions, memory referencing paths that no longer exist,
+  // and a stale INDEX.md "Last updated" stamp. Advisory only — never throws.
+  try {
+    const { checkDrift } = require(path.join(__dirname, '..', '..', 'rcode', 'bin', 'lib', 'memory-drift.cjs'));
+    result.drift = checkDrift(projectRoot);
+  } catch (err) {
+    result.drift = { drifts: [], error: err.message };
+  }
+
+  return result;
+}
+
+// TTL cache — checkDrift() shells out to git (up to two `git log`/`git show`
+// calls), so an unthrottled /api/memory would re-run those on every request.
+// Mirrors scanState's cache (see below) at a coarser interval since memory
+// content changes far less often than sprint/task state.
+let _memoryCache = null; // { rcodeDir, result, ts }
+const MEMORY_SCAN_TTL_MS = 5000;
+
+function scanMemoryBank(rcodeDir) {
+  const now = Date.now();
+  if (_memoryCache && _memoryCache.rcodeDir === rcodeDir && now - _memoryCache.ts < MEMORY_SCAN_TTL_MS) {
+    return _memoryCache.result;
+  }
+  const result = scanMemoryBankUncached(rcodeDir);
+  _memoryCache = { rcodeDir, result, ts: now };
   return result;
 }
 

package/server/lib/view-only.js

@@ -0,0 +1,32 @@
+/**
+ * view_only gate (#967) — shared between dashboard.js (hides Run/Stop/Clean
+ * affordances in the UI) and orchestrator.js (the actual server-side
+ * enforcement on POST /api/run). Hiding the button alone is not a fix: any
+ * automation that can drive the browser or read the orchestrator token can
+ * still POST /api/run directly and spawn a --dangerously-skip-permissions
+ * agent against the repo, so the refusal has to live on the server.
+ *
+ * `dashboard.view_only: true` in .rcode/config.yaml (or VIEW_ONLY=1/true in
+ * the environment) turns it on. Off by default — solo devs are unaffected.
+ */
+'use strict';
+
+const path = require('path');
+
+/**
+ * Re-read on every call (not cached) so toggling config.yaml takes effect
+ * without restarting the dashboard/orchestrator processes. config.yaml is a
+ * few hundred bytes, so the extra fs read per call is negligible.
+ */
+function isViewOnly(projectRoot) {
+  const envFlag = String(process.env.VIEW_ONLY || '').toLowerCase();
+  if (envFlag === '1' || envFlag === 'true') return true;
+  try {
+    const cfg = require(path.join(__dirname, '..', '..', 'rcode', 'bin', 'lib', 'config.cjs'));
+    return cfg.cmdGet(projectRoot, 'dashboard.view_only') === 'true';
+  } catch {
+    return false;
+  }
+}
+
+module.exports = { isViewOnly };