@sleep2agi/agent-network-dashboard 0.5.6 → 0.5.7-preview.0

package/docs/oss-readiness-report.md

@@ -1,189 +0,0 @@
-# Dashboard OSS Readiness Report
-
-**Repo**: `sleep2agi/agent-network-dashboard`
-**Scan date**: 2026-05-12
-**Auditor**: N站马 (Dashboard owner)
-**Status of repo at scan time**: pre-public, npm package already public under preview tag
-
----
-
-## TL;DR
-
-The repo was scanned for credentials, personal info, license issues, debug
-residue, security holes, and dependency posture. **One P0 issue was found
-(a leaked GitHub PAT in older git history) and resolved by force-pushing a
-fresh single-commit history (Vincent-approved nuclear option).** Remaining
-items are P1/P2 polish.
-
-Repo is **OSS-ready** once the leaked PAT is revoked at the GitHub side
-(rotation is on Vincent's checklist — history wipe alone doesn't help users
-who already cloned the leak).
-
----
-
-## 🚨 P0 — Resolved
-
-### P0-1. Leaked GitHub PAT in git history
-
-- **Token**: `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`
-- **Surface**: `.anet/nodes/N站牛/logs/2026-04-10.log` (agent inter-comm log
-  that captured the token verbatim in a CommHub message body when 通信龙
-  asked N站牛 to push a doc on his behalf).
-- **Reachable in commits**: `14707aa` (added) and `e13a382` (deleted).
-  Even though the file was deleted in `e13a382`, `git log -p` on any clone
-  prior to history wipe could recover it.
-- **Resolution** (this scan): Vincent approved nuclear option ("可以清空
-  commit 然后 init push -f"). Executed `git bundle create
-  /tmp/anet-dashboard-pre-wipe.bundle --all` for backup, then `rm -rf .git
-  && git init -b main && git add . && git commit && git push -f origin
-  main`. New initial commit `2aa6e95` is now the entire history; the old
-  graph is unreachable from `sleep2agi/agent-network-dashboard`.
-- **Outstanding action (Vincent)**: revoke the PAT at
-  https://github.com/settings/tokens. The token's bytes still live in
-  clones that pre-date the wipe and in the local backup bundle; only an
-  upstream revoke makes the credential dead. Earlier attempts to use the
-  token from our dev box returned "No such device or address" which
-  suggests it may already be inactive, but explicit revocation is the
-  belt-and-suspenders move before OSS.
-
-### P0-2. `.anet/` runtime directory contained tokens
-
-- **What**: The working tree's `.anet/.env` holds
-  `COMMHUB_TOKEN=ntok_f347c879b5cb4d23a89f5c4e56b21219` (current dev hub
-  service token). The full `.anet/` directory holds per-node configs,
-  session state, telegram channel inboxes, and dev logs.
-- **Surface**: `.anet/` is gitignored in HEAD's `.gitignore` and was
-  removed from git history by the wipe. Working tree only.
-- **Resolution**: `.gitignore` covers `.anet/` and `.npmignore` excludes
-  it. No follow-up code change needed in this audit.
-
----
-
-## ⚠️ P1 — OSS-blocking polish
-
-### P1-1. `npm audit` — 2 vulnerabilities
-
-```
-postcss <8.5.10  — moderate (XSS via Unescaped </style>)
-next 16.2.3      — high (transitive via postcss; fixable by next@16.2.6)
-```
-
-- **Fix path**: `npm audit fix --force` will bump Next to 16.2.6.
-- **Risk**: out-of-stated-dep-range jump; test the dashboard end-to-end
-  after the bump before promoting to a stable release.
-- **Recommendation**: do this in `0.4.5-preview.0`, NOT in 0.4.4-preview.0
-  (don't mix CVE fix and design polish in one preview, that complicates
-  diff review).
-
-### P1-2. TopoGraph still dark in light theme (GitHub issue #8)
-
-- **What**: `app/components/TopoGraph.tsx` SVG bg is `<linearGradient>
-  #0b1220→#080814→#101018` regardless of theme. In Light/Mint, the
-  visualization is a black square inside an otherwise white page.
-- **Why P1 not P0**: cosmetic, not a security/credential issue.
-- **Fix**: render a light-theme variant SVG (white bg + light-grey grid +
-  emerald node circles, no glow filter). ~150 LOC. Scheduled for
-  `0.4.5-preview.0`.
-
-### P1-3. README minimum bar
-
-- **What**: README.md exists (3.3KB) and covers install, usage, ENV vars.
-- **Gap for OSS**: no architecture overview, no contribution flow link
-  (CONTRIBUTING.md exists separately but README doesn't link it), no
-  screenshot/demo GIF, no "what is anet" context for first-time readers.
-- **Recommendation**: README expansion in `0.4.5-preview.0` or as its own
-  small commit between previews. Not a publish blocker.
-
-### P1-4. Hardcoded `console.warn` in production code
-
-- `app/lib/dashboard-auth.ts:37` — `console.warn('[dashboard] WARNING:
-  using CommHub token as login password. Set DASHBOARD_PASSWORD for
-  security.')`
-- This warning is legitimate (security-relevant configuration drift) and
-  intentionally guarded by `process.env._DASHBOARD_TOKEN_WARN_SHOWN` to
-  fire once per process. Keep.
-
----
-
-## ℹ️ P2 — Nice-to-have
-
-### P2-1. `dangerouslySetInnerHTML` in layout.tsx
-
-- `app/layout.tsx:49` — inline boot script that reads `localStorage` to
-  apply the persisted theme before React hydrates.
-- The script is a static literal (`themeBootScript` constant) with no
-  interpolated user input. Safe.
-
-### P2-2. Hardcoded `127.0.0.1:9200` defaults
-
-- Six route files default `HUB_URL` to `http://127.0.0.1:9200` when
-  `COMMHUB_URL` env is not set.
-- This is the documented behavior for `npx
-  @sleep2agi/agent-network-dashboard` against a local CommHub. Not
-  sensitive; keep.
-
-### P2-3. Author / homepage personal-ish
-
-- `package.json`: `"author": "sleep2agi"`, `"homepage":
-  "https://anet.sh"`. Both are project-level, not personal.
-- `README.md`: `Docs | https://anet.vansin.me`. This is Vincent's
-  personal subdomain. Recommend swapping to `https://docs.anet.sh` or
-  similar project domain when available.
-
-### P2-4. Dependency license posture
-
-```
-MIT:               115
-Apache-2.0:         10
-ISC:                 3
-LGPL-3.0-or-later:   2
-CC-BY-4.0:           1
-BSD-3-Clause:        1
-0BSD:                1
-```
-
-- **LGPL-3.0-or-later** (2 packages) is the only concern under
-  Apache-2.0. LGPL is GPL-family with a linking exception; combining
-  dynamically-linked LGPL with Apache-2.0 is generally accepted but
-  worth a one-time formal review by Vincent.
-- No GPL/AGPL pure-strong-copyleft deps detected.
-
-### P2-5. Test artifacts
-
-- `test-results/.last-run.json` was in the working tree (and in the
-  initial commit). It's gitignored going forward via the updated
-  `.gitignore`. Low-risk leaked dev metadata.
-
-### P2-6. Public domain alignment
-
-- Dashboard binds to `0.0.0.0:3000` by default (per `bin/start.js`).
-  Reasonable for a self-hosted dev tool; document that production
-  deployments should sit behind auth + TLS (already noted in README's
-  ENV section).
-
----
-
-## Scan methodology
-
-1. **Git history credential sweep** (now applied to the FRESH history
-   only, since old history was wiped):
-   ```bash
-   git log -p --all | grep -iE 'ghp_|github_pat_|sk-|api[-_ ]?key|secret|password=|token=|AKIA|AIza|npm_'
-   git log -p --all | grep -iE 'ntok_[a-f0-9]{16,}|utok_[a-f0-9]{16,}|atok_[a-f0-9]{16,}'
-   ```
-2. **Personal info**: `grep -rE "vansin|sleep2agi|msnode|wechat|feishu" --exclude-dir={node_modules,.next,.git,.anet}`
-3. **License**: `LICENSE` file present + `package.json` `license` field +
-   `npx license-checker --production --summary` for transitive deps.
-4. **Security primitives**: hand-grep `dangerouslySetInnerHTML`, native
-   `<select>`, hardcoded URLs/IPs, debug `console.log` patterns.
-5. **Dependency vulns**: `npm audit --omit=dev`.
-
----
-
-## Sign-off
-
-The repo at commit `2aa6e95` is **OSS-publishable** under Apache-2.0
-provided Vincent confirms the leaked PAT (`ghp_L9j2A…`) is revoked
-upstream. Remaining items (P1-1 npm audit, P1-2 TopoGraph light variant,
-P1-3 README polish) are ship-it-anyway-and-iterate-later items, not
-publish blockers.

package/docs/rfc/v0.10.0-hero3-dashboard-upgrade.md

@@ -1,230 +0,0 @@
-# RFC: v0.10.0 Hero 3 — Dashboard 网络节点前端展示升级
-
-**Status**: DRAFT — review pending
-**Author**: N站马 (`@sleep2agi/agent-network-dashboard` maintainer)
-**Filed against**: [#140](https://github.com/sleep2agi/agent-network/issues/140) (v0.10.0 tracking)
-**Related**: [#119](https://github.com/sleep2agi/agent-network/issues/119) (ServersDrawer), [#99](https://github.com/sleep2agi/agent-network/issues/99) (守护节点), [#114](https://github.com/sleep2agi/agent-network/issues/114) (Token stats), [#87](https://github.com/sleep2agi/agent-network/issues/87) (grid layout), [#81](https://github.com/sleep2agi/agent-network/issues/81) (fullscreen+zoom)
-**Output target**: `@sleep2agi/agent-network-dashboard@0.4.7+`
-**Generated**: 2026-05-16
-
----
-
-## 0. Scope-status caveat (READ FIRST)
-
-This RFC drafts the **Hero 3 (TopoGraph 升级)** scope. As of writing, [#140](https://github.com/sleep2agi/agent-network/issues/140) issue body **explicitly defers** "F Dashboard 0.5.x major" to **v0.11.0** in its `🚫 Defer 到 v0.11.0` section.
-
-The RFC is written under the **counterfactual assumption** that Vincent decides to pull Hero 3 forward into v0.10.0. If Vincent keeps the defer, all RFC content moves to v0.11.0 planning. **Vincent's call.**
-
-The author has not started implementation. No `preview.X+1` code ship has occurred for any Hero 3 item. Two related items (sweep arc retire + recent-signal hide-when-empty) were attempted earlier in the day under the Vincent 5222 Twitter-polish P0 and reverted by concurrent codex edits — those are documented in §3.B below and proposed for re-attempt only after Vincent ✅ on the v0.10.0 scope and codex coordination on the SVG edit region.
-
----
-
-## 1. Goal & success criteria
-
-The single sentence: **A first-time Twitter visitor sees the 16:9 screenshot and groks "多 agent 实时通信可视化 by sleep2agi"** — without "wow 太多花" reaction.
-
-Success criteria (each measurable):
-
-1. **First-glance brand recognition** — `sleep2agi` mark visible without scrolling, top-half of card.
-2. **Multi-vendor multi-agent legibility** — every node's vendor identity is distinguishable at thumbnail size; no two vendors look identical at the 16:9 crop.
-3. **Visual quietness when idle** — empty/no-flow state has ≤ 1 SMIL animation visible; no animated chrome competing for attention.
-4. **Information density legible** — chip-row, panels, and overlays don't crowd the canvas; the eye lands on nodes + edges first.
-5. **Server-health integration** — hovering a node surfaces its host server's health badge (Hero 1+2 integration).
-6. **Zero regression** on the 6 existing interaction contracts (per `feedback_5291_amendment` regression list).
-
----
-
-## 2. Current baseline (what shipped, what's held)
-
-### Already shipped this cycle (live in npm preview)
-
-| Round / commit | Surface | What |
-|---|---|---|
-| R301 `bbde2b7` | Vendor avatars | claude.svg + openai.svg + minimax.svg custom-designed badges (NOT trademark copies); rendered via `<image href={vendor.logo}>` per existing vendorIdentity.ts logo path |
-| R310 `b6da676` | Title block | Inline 36×36 crescent moon SVG left of the kicker+h2 pair (HTML side, theme-aware cyan/emerald color, racing-safe placement) |
-| R275-R281 | Canvas 减法 | freshness-conditional, orbit retired, halo retired, ping retired, dispatch-pulse retired, spokes retired, vendor-chip threshold tightened |
-| R282 `e1d324b` | Brand watermark | "sleep2agi" text at bottom-left (16, 672) |
-| R283-R289 | Typography | monogram stroke 1→1.5, monogram font monospace→sans-serif, kicker tracking-widest, h2 tracking-tight, watermark letterSpacing 0.5 |
-| R290-R291 | Canvas 减法 | Inner radar ring r=90 retired; starfield 28→14 dots |
-| R294-R296 (codex) | Canvas + chrome | Per-node pulse-dot retired; legend swatch r 5.5→6; kicker color gray-600→500 |
-
-### Held by codex-race / pending Vincent ✅ on this RFC
-
-| Item | Why held | Risk |
-|---|---|---|
-| sweep arc retire (rotating wedge) | Codex parallel SVG edits revert each attempt | Low — `false &&` gate idiom proven safe in R278/R279/R280; just needs no-race window |
-| recent-signal panel hide-when-empty | Same codex race | Low — single `flowLinks.length > 0 &&` JSX guard |
-| Canvas (16,16) watermark variant | recent-signal panel occupies that corner; current title-block placement is racing-safer alternative | Already mitigated by §2 title-block shipped |
-
----
-
-## 3. Proposed changes — per surface
-
-Each surface listed with: **A** = additive, **S** = subtractive, **U** = unification. Concrete edit, test impact, race risk.
-
-### 3.A — Hub center polish (A)
-
-- Embed a faint crescent silhouette **behind** the working-count digit at the hub center (r=12 mask, opacity 0.18). Reads as "sleep2agi heartbeat" without competing with the digit (R213 hub center).
-- Theme-aware via currentColor on the embedding `<g>`.
-- Risk: minimal — same `<defs>` + mask construction already used in title-block.
-
-### 3.B — Sweep arc retire (S)
-
-- Gate the existing radar sweep wedge with `{false && (() => {...})}` — same idiom as R278/R279/R280.
-- Reason: rotating decoration competes with the working-halo pulse + edge flow animation. On a 16:9 Twitter screenshot it reads "wow lots of motion" not "agents communicating".
-- Race-mitigation: ship this in a single small commit, paired with §3.C, immediately after Vincent ✅ on RFC; require codex to hold polish during that window (5min).
-
-### 3.C — Recent-signal panel hide-when-empty (S)
-
-- Wrap the `<g data-topo-panel="recent">` block in `{flowLinks.length > 0 && (...)}`.
-- First flow arrival triggers existing R175 fade-in. Empty corner stays clean for the Twitter-grok first impression.
-- Race-mitigation: same window as §3.B.
-
-### 3.D — Grid layout default for ≥ 20 nodes (S of ring-default)
-
-- Per [#87](https://github.com/sleep2agi/agent-network/issues/87) shipping ring/grid toggle, now switch the default **when** `sessions.length >= 20`. Below 20 nodes, ring stays prettier; above, grid scales cleaner.
-- Persist user override in `anet-topo-layout` localStorage (existing).
-- Risk: low — toggle UI unchanged; only the bootstrap default expression changes.
-
-### 3.E — Node detail card on hover (A)
-
-- Hover a node ≥ 200ms → show a small detail card (220×140 px) anchored next to the node:
-  - alias (large)
-  - vendor.label · model id
-  - runtime label
-  - host server line: hostname + CPU% + RAM% (from Hero 1+2 endpoint)
-  - last_task / message preview (1 line)
-- Reuses R57 panel chrome + R26 micro-lift idiom.
-- Risk: zero-overlap — card is positioned via existing label-card geometry, just larger when sustained-hover; cancel on mouseleave.
-
-### 3.F — Server-health node-ring tint (A · Hero 1+2 integration)
-
-- When a node's host server health is **red** (per Hero 1+2 endpoint), the node's status ring gains a faint amber outer ring (r+8, strokeWidth=2.5, opacity 0.6).
-- Yellow/green pass through unchanged.
-- Operator gets "this agent's machine is in trouble" signal without leaving the topology view.
-- Risk: zero-overlap — outer ring sits OUTSIDE existing R209 hover-ring radius window; tested geometry.
-
-### 3.G — Fullscreen viewport polish (#81 close-out) (U)
-
-- Existing fullscreen (R103) currently swaps to `width: 100vw; height: 100vh`. In fullscreen, the topology card chrome (kicker / h2 / chip-row) should hide — only canvas + brand logo visible.
-- Add CSS `:fullscreen` selector or `data-topo-fullscreen=true` attr-driven hide of title-block + chip-row.
-- Brand crescent moon moves into a small top-left overlay inside the SVG (16, 16) since the title-block disappears.
-- Risk: needs careful keyboard-focus handling — ensure Esc still exits.
-
-### 3.H — Chip-row default collapse on idle (S/U)
-
-- Chip row (`Ring | Grid | 3 working | 5 online | pressure …`) is fully visible by default. On a fleet with no traffic that's chrome bloat.
-- Default: show only **2 chips** (Ring/Grid layout toggle + working count). The rest hide behind an "Expand" toggle / `…` chevron.
-- Expand state persists in localStorage.
-- Risk: medium — needs UX think. Maybe ship as opt-in via setting, not silent default change.
-
-### 3.I — Canvas (16,16) corner brand mark (A)
-
-- In addition to the title-block crescent (R310), add a small (24×24) crescent at canvas viewBox (16, 16) **only when no recent-signal panel is showing** (composes with §3.C).
-- Doubles the brand mark presence on Twitter screenshots — title-block + canvas corner = brand-first.
-- Risk: zero-overlap — gated on the same `flowLinks.length === 0` predicate as §3.C; never co-exists with the panel.
-
----
-
-## 4. Hero 1+2 integration touchpoints
-
-This RFC is the dashboard "consumer" side. The actual data contracts (per [#119](https://github.com/sleep2agi/agent-network/issues/119) + [#99](https://github.com/sleep2agi/agent-network/issues/99)) are owned by:
-
-- **agent-node telemetry** → SDK马 / 工程马 (CPU/mem/disk per-agent into `report_status`)
-- **CommHub aggregation** → 通信牛 (`GET /api/servers`, `GET /api/server/:host/health`, `/agents`)
-- **N站马 dashboard UI** consumes these and renders §3.E (hover detail), §3.F (red-server tint), and the standalone ServersDrawer page (Track 1, separate from Hero 3).
-
-This RFC does **not** block on those endpoints — §3.E and §3.F render in degraded form (no host fields) when the endpoint is absent, and light up automatically when the endpoint ships.
-
-For ServersDrawer (Track 1), I'll mock with a fixture against the §[3] schema in [#119](https://github.com/sleep2agi/agent-network/issues/119) and replace with the real endpoint once 通信牛 confirms the contract.
-
----
-
-## 5. Risk & rollback
-
-### Concurrent-editor race (per `project_dashboard_concurrent_editors` memory)
-
-- All §3 surface items live inside `app/components/TopoGraph.tsx` — high parallel-edit traffic with codex.
-- **Mitigation**: bunch §3.B + §3.C + §3.I into one commit, immediately after Vincent ✅ on RFC; coordinate via commhub that codex holds polish edits for 10 min during the ship.
-- **Rollback**: each subtractive item uses `false && (() => {...})` gating — single-character flip restores.
-
-### Regression coverage (per `feedback_5291_amendment`)
-
-Each preview ship verifies:
-
-- 9 components render: TopoGraph / ServersDrawer / NodeCard / ChatModal / EventStream / TopBar / VersionSwitcher / ServerCard / AgentTokenChip
-- 6 interactions don't break: avatar click → ChatPopover (#100), drag-resize (#106), node delete cleanup (#74), vendor LOGO render (#96), grid toggle (#87), fullscreen zoom+pan (#81)
-- 5 pages render: `/`, `/admin`, `/chat`, `/messages`, `/profile`
-- `topo-overlap-test.mjs` green grid+ring (0:0:0:0:0)
-- `curl http://dm.vansin.top:3000/` returns 307 (auth redirect; normal)
-- `curl https://anet.sh` returns 200
-
-### Test regressions known from R301 + R310
-
-- `topo-monogram-stroke-test` (R283) and `topo-monogram-font-test` (R284) FAIL for known vendors after R301 vendor-logo upgrade (avatar circle replaced with `<image>` for vendors with logos). **Expected** — those R283/R284 fine-grain monogram tests are obsolete for vendors with real logo assets. Unknown-vendor prefix-group fallback assertions still pass. Will retire those two test files in the next ship.
-- `topo-kicker-tracking-test` and `topo-title-tracking-test`: occasional Playwright `waitForSelector` timeout after R310 flex-row title block. Element exists + renders correctly per diagnostic + screenshot. Hydration-timing flake. Will add `await page.waitForFunction(() => document.querySelectorAll('g[data-node]').length >= 2)` before the visibility check.
-
----
-
-## 6. Phasing
-
-Recommended chunking for `preview.X` slots, smallest-blast-radius first:
-
-**Wave 1 — racing-safe quick wins (10 min ship + verify, single commit)**:
-- §3.B sweep retire
-- §3.C recent-signal hide-when-empty
-- §3.I canvas (16,16) brand mark (gated on §3.C)
-- → preview.X.0
-
-**Wave 2 — incremental polish (no Hero 1+2 dependency)**:
-- §3.A hub-center crescent silhouette
-- §3.D grid default for ≥ 20 nodes
-- §3.G fullscreen viewport polish (#81 close-out)
-- → preview.X.1 / preview.X.2
-
-**Wave 3 — Hero 1+2 integration (after 通信牛 endpoint ships)**:
-- §3.E hover detail card
-- §3.F server-health node-ring tint
-- → preview.X.3 / preview.X.4
-
-**Wave 4 — UX-think items (opt-in, not silent)**:
-- §3.H chip-row default collapse — gated behind a setting toggle, not auto-applied
-- → preview.X.5
-
----
-
-## 7. Open questions for Vincent
-
-1. **Defer status**: #140 currently defers Hero 3 (Dashboard 0.5.x major) to v0.11.0. Is the channel-relay correct that you've pulled it forward to v0.10.0? Or does it stay deferred? **If deferred, this RFC moves to v0.11.0 planning.**
-
-2. **Scope inclusion**: of the 9 items (§3.A through §3.I), which are in v0.10.0 scope and which (if any) are dropped? My recommended cut, if any: §3.H (chip-row default collapse) — high UX risk, low first-glance impact.
-
-3. **Server-health hover**: do you want host CPU/RAM in the **hover** card (§3.E), or only on the dedicated ServersDrawer page (Track 1)? Both surfaces the data; hover is denser but adds load on every node lookup.
-
-4. **Brand-mark double-up**: title-block crescent (already shipped R310) + canvas corner crescent (proposed §3.I) — too much logo, or two complementary anchors?
-
-5. **Codex coordination**: §3.B/§3.C/§3.I need a no-race ship window. Acceptable to dispatch a 10-min "codex hold polish" via 通信龙 for the Wave 1 ship?
-
----
-
-## 8. Non-goals (explicitly out of scope for this RFC)
-
-- Hero 1+2 ServersDrawer **page-level** implementation — that's Track 1, a separate RFC slot if needed (current ServersDrawer per #119 v1 already exists).
-- Token usage UI (#114) — Track 3 of v0.10.0, separate UI consumer.
-- Backend changes (commhub endpoints, agent-node telemetry) — Hero 1+2 owned by 通信牛 + SDK马.
-- Fine-grain typography / opacity / tabular-nums work — those are the post-5222 polish loop items that remain HOLD.
-
----
-
-## 9. Approval gate
-
-Implementation does **not** start on any §3 item until:
-
-1. Vincent acks the RFC scope (defer-or-include decision per Question 1) AND
-2. Vincent picks the §3 subset to actually ship (Question 2) AND
-3. For Wave 1 specifically, 通信龙 dispatches a 10-min codex polish-hold to avoid edit race AND
-4. The `topo-overlap-test` invariant is verified green pre-ship.
-
----
-
-*This RFC is markdown-only. No code in this PR / commit. Next step: post as a comment on [#140](https://github.com/sleep2agi/agent-network/issues/140), wait for Vincent review.*