@matt82198/aesop 0.1.0-beta.4 → 0.1.0-rc.1

package/ui/handler.py

@@ -3,14 +3,17 @@
 import http.server
 import json
 import queue
+import socketserver
 import sys
 import threading
 import urllib.parse
 from pathlib import Path
 
 import config
+import cost
 import csrf
 import sse
+import wave_prs
 import api
 import api.tracker
 import api.submit
@@ -23,11 +26,145 @@ from collectors import (_snapshot_data, _snapshot_tracker,
                        get_recent_events, get_repos_status,
                        parse_audit_backlog)
 from agents import (_AGENT_ID_FORBIDDEN, _transcripts_fingerprint,
-                   extract_agent_dispatch_prompt, get_fleet_agents)
+                   extract_agent_dispatch_prompt, get_agent_detail,
+                   get_fleet_agents)
 from sse import (_latest_lock, _latest_snapshots, _maybe_emit,
                 register_sse_client, unregister_sse_client)
 
 
+# SSE section names, in emit order. /api/state returns the same sections so the
+# frontend's first paint is one round trip (plan D3.1).
+_STATE_SECTIONS = ("data", "backlog", "agents", "tracker", "status", "cost")
+
+
+def _path_is_contained(child, root):
+    """Check if child path is contained within root path (no traversal).
+
+    Returns True if child is under root, False if it escapes (e.g., via ..).
+    Uses Path.is_relative_to (Python 3.9+) with a fallback for older runtimes.
+
+    Args:
+        child: Path object (typically resolved)
+        root: Path object (typically resolved)
+
+    Returns:
+        bool: True if child is contained within root, False otherwise
+    """
+    try:
+        return child.is_relative_to(root.resolve())
+    except AttributeError:
+        # Path.is_relative_to requires Python 3.9+; fall back for older runtimes.
+        try:
+            child.relative_to(root.resolve())
+            return True
+        except ValueError:
+            return False
+
+# MIME types for the built dist's content-hashed assets (wave-14, plan D3.4).
+_ASSET_MIME = {
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".map": "application/json; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".woff2": "font/woff2",
+    ".woff": "font/woff",
+    ".png": "image/png",
+    ".ico": "image/x-icon",
+}
+
+
+def _is_local_origin(origin):
+    """True if an Origin header value is on the local allowlist.
+
+    Keep in sync with csrf.validate_csrf_request(): same six local forms
+    (http[s]://127.0.0.1:<port>, http[s]://localhost:<port>, http[s]://[::1]:<port>).
+    Both http:// and https:// schemes are accepted for the same loopback hosts.
+    """
+    return bool(origin) and (
+        origin.startswith("http://127.0.0.1:") or
+        origin.startswith("https://127.0.0.1:") or
+        origin.startswith("http://localhost:") or
+        origin.startswith("https://localhost:") or
+        origin.startswith("http://[::1]:") or
+        origin.startswith("https://[::1]:")
+    )
+
+
+def _is_valid_host_header(host_header, expected_port):
+    """True if Host header value is on the loopback allowlist.
+
+    DNS-rebinding mitigation (wave-19): validates that the Host header
+    matches one of the allowed loopback addresses with the correct port.
+
+    Allowed forms (where port matches expected_port):
+    - 127.0.0.1 (no port, implies http default)
+    - 127.0.0.1:<port>
+    - localhost (no port)
+    - localhost:<port>
+    - [::1] (IPv6 loopback, no port)
+    - [::1]:<port>
+
+    Args:
+        host_header: The value of the Host header (may be None/empty)
+        expected_port: the port the server is actually bound to (validate
+            against the live socket, not config.PORT — a test or a
+            dynamically-assigned ephemeral port can differ from config)
+
+    Returns:
+        bool: True if host is on the local allowlist, False otherwise
+    """
+    if not host_header:
+        return False
+
+    host_header = host_header.strip()
+
+    # Extract host and port from the header value
+    # Handle IPv6 format [::1]:port
+    if host_header.startswith("["):
+        # IPv6 format: [::1] or [::1]:port
+        if "]" not in host_header:
+            return False
+        bracket_end = host_header.index("]")
+        host_part = host_header[:bracket_end + 1]  # Include brackets
+        remainder = host_header[bracket_end + 1:]
+        if remainder:
+            # Port must follow immediately with a colon
+            if not remainder.startswith(":"):
+                return False
+            try:
+                port_part = int(remainder[1:])
+            except (ValueError, IndexError):
+                return False
+        else:
+            port_part = None
+    else:
+        # IPv4 or hostname format: 127.0.0.1, 127.0.0.1:port, localhost, localhost:port
+        if ":" in host_header:
+            host_part, port_str = host_header.rsplit(":", 1)
+            try:
+                port_part = int(port_str)
+            except ValueError:
+                return False
+        else:
+            host_part = host_header
+            port_part = None
+
+    # Check if host is on allowlist (127.0.0.1, localhost, or [::1])
+    # RFC 7230: hostnames are case-insensitive, so lowercase before comparing
+    allowed_hosts = ("127.0.0.1", "localhost", "[::1]")
+    if host_part.lower() not in allowed_hosts:
+        return False
+
+    # If a port was specified, it must match the server's actual bound port
+    if port_part is not None:
+        if port_part != expected_port:
+            return False
+
+    return True
+
+
 class DashboardHandler(http.server.BaseHTTPRequestHandler):
     """HTTP request handler for dashboard."""
 
@@ -37,25 +174,64 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
 
     def do_GET(self):
         """Handle GET requests."""
+        # DNS-rebinding mitigation: validate Host header against allowlist
+        host_header = self.headers.get("Host", "").strip()
+        if not _is_valid_host_header(host_header, self.server.server_address[1]):
+            self.send_response(403)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(json.dumps(
+                {"error": "Forbidden: invalid Host header"}
+            ).encode('utf-8'))
+            return
+
         if self.path == "/":
             self.serve_html()
         elif self.path == "/data":
             self.serve_data()
+        elif self.path == "/api/state":
+            self.serve_api_state()
+        elif self.path == "/api/session":
+            self.serve_api_session()
+        elif self.path == "/api/cost":
+            self.serve_api_cost()
+        elif self.path == "/api/wave/prs":
+            self.serve_api_wave_prs()
         elif self.path == "/api/backlog":
             self.serve_backlog()
         elif self.path == "/api/agents":
             self.serve_agents()
+        elif self.path.startswith("/api/agent?"):
+            self.serve_api_agent()
         elif self.path.startswith("/api/tracker"):
             self.serve_tracker()
+        elif self.path.startswith("/assets/"):
+            self.serve_asset()
         elif self.path.startswith("/agent?"):
             self.serve_agent()
         elif self.path == "/events":
             self.serve_events()
+        elif self.path == "/favicon.ico":
+            # Browsers auto-request this; answer 204 so it never 404s (keeps the
+            # console clean — the dashboard ships no favicon asset).
+            self.send_response(204)
+            self.end_headers()
         else:
             self.send_error(404)
 
     def do_POST(self):
         """Handle POST requests."""
+        # DNS-rebinding mitigation: validate Host header against allowlist
+        host_header = self.headers.get("Host", "").strip()
+        if not _is_valid_host_header(host_header, self.server.server_address[1]):
+            self.send_response(403)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(json.dumps(
+                {"error": "Forbidden: invalid Host header"}
+            ).encode('utf-8'))
+            return
+
         if self.path == "/submit":
             self.handle_submit()
         elif self.path == "/api/tracker":
@@ -66,14 +242,191 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.send_error(404)
 
     def serve_html(self):
-        """Serve the dashboard HTML."""
-        html = render_dashboard(csrf.SESSION_TOKEN)
+        """Serve the dashboard HTML.
+
+        Wave-14 (plan D3.4/D7 U9 cutover): the built frontend at
+        config.WEB_DIST/index.html is always required and must be present;
+        if missing, return a hard 500 with a clear error (never fall back to
+        a legacy template). config.WEB_DIST is read at call time so
+        config.reload() keeps working across fixtures.
+        """
+        dist_index = config.WEB_DIST / "index.html"
+        if not dist_index.is_file():
+            error_msg = (
+                "built dashboard missing — run npm run build in ui/web"
+            )
+            self.send_response(500)
+            self.send_header("Content-Type", "text/plain; charset=utf-8")
+            self.send_header("Cache-Control", "no-cache, no-store, must-revalidate")
+            self.end_headers()
+            self.wfile.write(error_msg.encode('utf-8'))
+            return
+
+        html = render_dashboard(csrf.SESSION_TOKEN, template_path=dist_index)
         self.send_response(200)
         self.send_header("Content-Type", "text/html; charset=utf-8")
         self.send_header("Cache-Control", "no-cache, no-store, must-revalidate")
         self.end_headers()
         self.wfile.write(html.encode('utf-8'))
 
+    def serve_asset(self):
+        """GET /assets/* — static files from the built dist (config.WEB_DIST/assets).
+
+        Security: path-traversal containment via resolve() + is_relative_to,
+        mirroring the pattern in agents.py — the resolved candidate must stay
+        inside WEB_DIST/assets or the request is refused. URL-encoded (%2e%2e,
+        %2f, %5c) and absolute-path inputs are decoded first so the containment
+        check sees the real target.
+
+        Caching: filenames are content-hashed by the Vite build, so responses
+        are immutable (Cache-Control: public, max-age=31536000, immutable).
+        """
+        try:
+            assets_root = config.WEB_DIST / "assets"
+            if not assets_root.is_dir():
+                # No built dist present (pre-cutover main) — nothing to serve.
+                self.send_error(404)
+                return
+
+            raw_path = urllib.parse.urlparse(self.path).path
+            rel = urllib.parse.unquote(raw_path[len("/assets/"):])
+            if not rel or "\x00" in rel:
+                self.send_error(404)
+                return
+
+            candidate = (assets_root / rel).resolve()
+
+            # Containment check: the resolved target must stay inside
+            # WEB_DIST/assets. Uses _path_is_contained helper for clarity.
+            if not _path_is_contained(candidate, assets_root):
+                self.send_error(403)
+                return
+
+            if not candidate.is_file():
+                self.send_error(404)
+                return
+
+            content = candidate.read_bytes()
+            mime = _ASSET_MIME.get(candidate.suffix.lower(), "application/octet-stream")
+            self.send_response(200)
+            self.send_header("Content-Type", mime)
+            self.send_header("Content-Length", str(len(content)))
+            self.send_header("Cache-Control", "public, max-age=31536000, immutable")
+            self.end_headers()
+            self.wfile.write(content)
+        except (BrokenPipeError, ConnectionAbortedError, ConnectionResetError, OSError):
+            pass  # client went away mid-response — normal, not an error
+        except Exception as e:
+            print(f"[serve_asset] Uncaught exception: {e}", file=sys.stderr)
+            self.send_error(500)
+
+    def serve_api_state(self):
+        """GET /api/state — consolidated snapshot of all six SSE sections.
+
+        One round trip for the frontend's first paint (plan D3.1). Reuses the
+        collectors' latest-snapshot mechanism: sections the background collector
+        has already produced are returned as-is; anything not yet snapshotted
+        (first-ever request) is computed inline, mirroring serve_events.
+        """
+        try:
+            sse.start_collector_thread()
+            with _latest_lock:
+                latest = dict(_latest_snapshots)
+
+            computers = {
+                "data": _snapshot_data,
+                "backlog": parse_audit_backlog,
+                "agents": get_fleet_agents,
+                "tracker": _snapshot_tracker,
+                "status": _snapshot_orchestrator_status,
+                "cost": cost.get_cost_summary,
+            }
+            state = {}
+            for name in _STATE_SECTIONS:
+                payload = latest.get(name)
+                if payload is not None:
+                    state[name] = json.loads(payload)
+                else:
+                    state[name] = computers[name]()
+
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.send_header("Cache-Control", "no-cache, no-store, must-revalidate")
+            self.end_headers()
+            self.wfile.write(json.dumps(state, default=str).encode('utf-8'))
+        except Exception as e:
+            print(f"[serve_api_state] Uncaught exception: {e}", file=sys.stderr)
+            self.send_response(500)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
+
+    def serve_api_session(self):
+        """GET /api/session — the CSRF token for same-origin JS (plan D3.3).
+
+        Exists so the Vite dev server (which cannot do the sentinel
+        substitution) still gets a working token; the built app keeps the
+        sentinel-injection path as primary.
+
+        SECURITY — Origin-checked FAIL-CLOSED: unlike the mutation endpoints
+        (where a missing Origin is tolerated because the token itself gates the
+        write), this endpoint HANDS OUT the token, so absence of an Origin
+        header is a refusal. Only the same local allowlist csrf.py uses
+        (127.0.0.1 / localhost / [::1]) is accepted.
+        """
+        origin = self.headers.get("Origin", "").strip()
+        if not _is_local_origin(origin):
+            self.send_response(403)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(json.dumps(
+                {"error": "Forbidden: /api/session requires a local Origin header"}
+            ).encode('utf-8'))
+            return
+
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Cache-Control", "no-cache, no-store, must-revalidate")
+        self.end_headers()
+        self.wfile.write(json.dumps({"token": csrf.SESSION_TOKEN}).encode('utf-8'))
+
+    def serve_api_cost(self):
+        """GET /api/cost — cost/scorecard summary from the outcomes ledger (plan D3.2)."""
+        try:
+            summary = cost.get_cost_summary()
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.send_header("Cache-Control", "no-cache, no-store, must-revalidate")
+            self.end_headers()
+            self.wfile.write(json.dumps(summary, default=str).encode('utf-8'))
+        except Exception as e:
+            print(f"[serve_api_cost] Uncaught exception: {e}", file=sys.stderr)
+            self.send_response(500)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
+
+    def serve_api_wave_prs(self):
+        """GET /api/wave/prs — open PRs + PR-less feat/* branches for the PR board.
+
+        Read-only; runs `gh pr list` / `git for-each-ref` (short timeout, cached
+        a few seconds). Degrades to a well-formed {available:false, error:...}
+        payload when gh is missing or un-authenticated — never a 500 for those.
+        """
+        try:
+            payload = wave_prs.get_wave_prs()
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.send_header("Cache-Control", "no-cache, no-store, must-revalidate")
+            self.end_headers()
+            self.wfile.write(json.dumps(payload, default=str).encode('utf-8'))
+        except Exception as e:
+            print(f"[serve_api_wave_prs] Uncaught exception: {e}", file=sys.stderr)
+            self.send_response(500)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
+
     def serve_data(self):
         """Serve dashboard data as JSON."""
         data = {
@@ -107,10 +460,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps(body, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[serve_tracker] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
     def handle_tracker_create(self):
         """Handle POST /api/tracker (create item)."""
@@ -132,10 +486,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps(result, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[handle_tracker_create] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
     def handle_tracker_mutate(self):
         """Handle POST /api/tracker/<id> (update or delete)."""
@@ -180,10 +535,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
                 self.end_headers()
                 self.wfile.write(json.dumps(result, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[handle_tracker_mutate] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
 
     def serve_backlog(self):
@@ -196,10 +552,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps(data, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[serve_backlog] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
     def serve_agents(self):
         """Serve rich agent list with metadata via GET /api/agents."""
@@ -211,10 +568,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps(agents, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[serve_agents] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
     def serve_agent(self):
         """Serve agent dispatch prompt and metadata via GET /agent?id=<agent_id>"""
@@ -257,6 +615,49 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             print(f"[serve_agent] Uncaught exception: {e}", file=sys.stderr)
             self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
+    def serve_api_agent(self):
+        """GET /api/agent?id=<agent_id> — agent detail for the Inspector drawer.
+
+        Read-only. Returns the dispatch prompt/metadata PLUS a bounded, secret-
+        redacted transcript tail (last ~40 NDJSON lines, seek-read so a huge
+        transcript is never fully loaded). Same id-safety + status-code contract
+        as GET /agent: rejected input -> 400, well-formed id with no transcript
+        -> 404, unexpected failure -> 500. Never leaks a raw traceback.
+        """
+        try:
+            query = urllib.parse.urlparse(self.path).query
+            params = urllib.parse.parse_qs(query)
+            agent_id = params.get('id', [None])[0]
+
+            if not agent_id:
+                self.send_response(400)
+                self.send_header("Content-Type", "application/json; charset=utf-8")
+                self.end_headers()
+                self.wfile.write(json.dumps({"error": "missing id parameter"}).encode('utf-8'))
+                return
+
+            data = get_agent_detail(agent_id)
+
+            if "error" in data:
+                status = 400 if data.get("invalid") else 404
+                self.send_response(status)
+                self.send_header("Content-Type", "application/json; charset=utf-8")
+                self.end_headers()
+                self.wfile.write(json.dumps({"error": data["error"]}).encode('utf-8'))
+                return
+
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.send_header("Cache-Control", "no-cache, no-store, must-revalidate")
+            self.end_headers()
+            self.wfile.write(json.dumps(data, default=str).encode('utf-8'))
+        except Exception as e:
+            self.send_response(500)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.end_headers()
+            print(f"[serve_api_agent] Uncaught exception: {e}", file=sys.stderr)
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
+
     def _write_sse_event(self, event_name, payload):
         """Write one SSE frame with timeout. Caller handles disconnect exceptions."""
         msg = f"event: {event_name}\ndata: {payload}\n\n"
@@ -325,10 +726,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
                 initial["agents"] = json.dumps(get_fleet_agents(), default=str, sort_keys=True)
                 initial["tracker"] = json.dumps(_snapshot_tracker(), default=str, sort_keys=True)
                 initial["status"] = json.dumps(_snapshot_orchestrator_status(), default=str, sort_keys=True)
+                initial["cost"] = json.dumps(cost.get_cost_summary(), default=str, sort_keys=True)
                 with _latest_lock:
                     _latest_snapshots.update(initial)
 
-            for name in ("data", "backlog", "agents", "tracker", "status"):
+            for name in _STATE_SECTIONS:
                 payload = initial.get(name)
                 if payload is not None:
                     self._write_sse_event(name, payload)
@@ -373,7 +775,7 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
                 return
 
             body_bytes = self.rfile.read(content_length)
-            data = json.loads(body_bytes.decode('utf-8', errors='ignore'))
+            data = json.loads(body_bytes.decode('utf-8', errors='replace'))
             text = data.get("text", "").strip()
 
             if not text:
@@ -397,10 +799,44 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps({"ok": True}).encode('utf-8'))
         except Exception as e:
+            print(f"[handle_submit] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
+
+
+class QuietThreadingHTTPServer(http.server.ThreadingHTTPServer):
+    """ThreadingHTTPServer that suppresses expected socket disconnect exceptions.
+
+    During normal operation and especially during shutdown, ThreadingHTTPServer may
+    encounter ConnectionAbortedError (WinError 10053) or ConnectionResetError
+    (WinError 10054) when clients disconnect abruptly. These are expected, not errors,
+    and clutter stderr with tracebacks.
+
+    This server overrides handle_error() to suppress only these two exception types
+    while still reporting all other exceptions (real bugs, timeouts, etc.).
+    """
+
+    def handle_error(self, request, client_address):
+        """Suppress client disconnect exceptions; report all others.
+
+        Args:
+            request: The socket request object
+            client_address: The client address tuple
+        """
+        exc_type, exc_value, exc_tb = sys.exc_info()
+
+        # Suppress only the two disconnect exception types that occur during
+        # normal client aborts (especially on shutdown). All other exceptions
+        # (real bugs, timeouts, etc.) still get logged via super().
+        if exc_type in (ConnectionAbortedError, ConnectionResetError):
+            # Expected client disconnect; silent is correct.
+            return
+
+        # All other exceptions get the default handler (logged to stderr)
+        super().handle_error(request, client_address)
+
 
 def run_server():
     """Start the HTTP server.
@@ -409,9 +845,11 @@ def run_server():
     connection open for the life of the client, so a single-threaded server would
     wedge every other request (including the initial page load and /submit)
     behind that one held connection.
+
+    Uses QuietThreadingHTTPServer to suppress expected socket disconnect exceptions.
     """
     addr = ("127.0.0.1", config.PORT)
-    httpd = http.server.ThreadingHTTPServer(addr, DashboardHandler)
+    httpd = QuietThreadingHTTPServer(addr, DashboardHandler)
     httpd.daemon_threads = True
     sse.start_collector_thread()
     print(f"Dashboard: http://localhost:{config.PORT}")

package/ui/render.py

@@ -2,10 +2,15 @@
 """
 Aesop UI template rendering — stdlib-only.
 
-The dashboard HTML/CSS/JS lives in templates/dashboard.html (extracted from
-serve.py in the wave-9 split). The only server-side substitution is the
-per-session CSRF token, injected via a unique sentinel so the template stays a
-plain static file (no .format()/% — the CSS/JS is full of { } and % literals).
+The legacy dashboard HTML/CSS/JS lives in templates/dashboard.html (extracted
+from serve.py in the wave-9 split). Wave-14 (dashboard rewrite, plan D3/D7)
+retargets the same mechanism at the built React app: the handler passes
+ui/web/dist/index.html as template_path when a committed dist is present, and
+falls back to the legacy template otherwise. The only server-side substitution
+is the per-session CSRF token, injected via a unique sentinel so the template
+stays a plain static file (no .format()/% — the CSS/JS is full of { } and %
+literals; the Vite build passes the sentinel-carrying inline script through
+verbatim).
 """
 import json
 import os
@@ -17,13 +22,28 @@ _DASHBOARD_HTML = os.path.join(_TEMPLATE_DIR, "dashboard.html")
 _CSRF_SENTINEL = "__AESOP_CSRF_SENTINEL__"
 
 
-def render_dashboard(session_token):
+def render_dashboard(session_token, template_path=None):
     """Return the dashboard HTML with the CSRF token substituted in.
 
+    Args:
+        session_token: the per-session CSRF token to inject.
+        template_path: path to the template file carrying the CSRF sentinel
+            (wave-14 U9 cutover: dist/index.html is always required; no
+            fallback to templates/dashboard.html).
+
     Reads the template fresh each call (cheap; keeps edits live in dev). The
     token is inserted as a JS string literal via json.dumps so it is always a
     valid, properly-quoted value.
+
+    Raises:
+        TypeError: if template_path is None (legacy fallback removed at U9).
+        FileNotFoundError: if the template file does not exist.
     """
-    with open(_DASHBOARD_HTML, encoding="utf-8") as f:
+    if template_path is None:
+        raise TypeError(
+            "render_dashboard() requires template_path after wave-14 U9 cutover; "
+            "legacy fallback to templates/dashboard.html has been removed"
+        )
+    with open(template_path, encoding="utf-8") as f:
         html = f.read()
     return html.replace(_CSRF_SENTINEL, json.dumps(session_token))