@vibecodetown/mcp-server 1.3.1 → 1.5.0

package/build/dashboard/server.js

@@ -16,14 +16,16 @@
  * NOTE:
  * - 프로덕션 서버는 별도 분리 가능 (여긴 최소 로컬 서버)
  */
-import * as http from "node:http";
-import { createLivenessHandler, createReadinessHandler, serverRunningChecker, } from "../health/index.js";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as os from "node:os";
-import * as crypto from "node:crypto";
-import { SyncPacketBuilder } from "../sync-packet-builder.js";
-const DEFAULT_STORAGE_DIR = path.join(os.homedir(), ".vibe", "dashboard");
+import * as http from 'node:http';
+import { logger } from '../shared/logger.js';
+import { createLivenessHandler, createReadinessHandler, serverRunningChecker, } from '../health/index.js';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as crypto from 'node:crypto';
+import { SyncPacketBuilder, } from '../sync-packet-builder.js';
+import { createSignalStreamHandler } from './signal_stream.js';
+const DEFAULT_STORAGE_DIR = path.join(os.homedir(), '.vibe', 'dashboard');
 function ensureDir(dir) {
     if (!fs.existsSync(dir))
         fs.mkdirSync(dir, { recursive: true });
@@ -31,14 +33,14 @@ function ensureDir(dir) {
 function sendJson(res, status, obj) {
     const body = JSON.stringify(obj, null, 2);
     res.statusCode = status;
-    res.setHeader("Content-Type", "application/json; charset=utf-8");
-    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('Access-Control-Allow-Origin', '*');
     res.end(body);
 }
 function sendText(res, status, text) {
     res.statusCode = status;
-    res.setHeader("Content-Type", "text/plain; charset=utf-8");
-    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+    res.setHeader('Access-Control-Allow-Origin', '*');
     res.end(text);
 }
 function readRequestBody(req, maxBytes) {
@@ -46,49 +48,49 @@ function readRequestBody(req, maxBytes) {
         let total = 0;
         let chunks = [];
         let rejected = false;
-        req.on("data", (chunk) => {
+        req.on('data', (chunk) => {
             if (rejected)
                 return;
             total += chunk.length;
             if (total > maxBytes) {
                 rejected = true;
                 chunks = []; // Release memory immediately
-                reject(new Error("body_too_large"));
+                reject(new Error('body_too_large'));
                 req.destroy();
                 return;
             }
             chunks.push(chunk);
         });
-        req.on("end", () => {
+        req.on('end', () => {
             if (rejected)
                 return;
-            const result = Buffer.concat(chunks).toString("utf-8");
+            const result = Buffer.concat(chunks).toString('utf-8');
             chunks = []; // Release memory after concatenation
             resolve(result);
         });
-        req.on("error", (err) => {
+        req.on('error', err => {
             chunks = []; // Release memory on error
             reject(err);
         });
     });
 }
 function parseBearerToken(req) {
-    const raw = String(req.headers["authorization"] ?? "");
+    const raw = String(req.headers['authorization'] ?? '');
     const m = raw.match(/^Bearer\s+(.+)$/i);
     return m?.[1]?.trim() || null;
 }
 function verifySignatureIfConfigured(packet) {
-    const publicKeyPem = (process.env.VIBE_CLOUD_SYNC_SIGNING_PUBLIC_KEY_PEM || "").trim();
+    const publicKeyPem = (process.env.VIBE_CLOUD_SYNC_SIGNING_PUBLIC_KEY_PEM || '').trim();
     if (!publicKeyPem)
         return { ok: true };
     if (!packet.signature)
-        return { ok: false, message: "missing_signature" };
+        return { ok: false, message: 'missing_signature' };
     try {
-        const payload = Buffer.from(`${packet.run_id}.${packet.iv}.${packet.tag}.${packet.content}.${packet.version}`, "utf-8");
-        const sig = Buffer.from(packet.signature, "base64url");
+        const payload = Buffer.from(`${packet.run_id}.${packet.iv}.${packet.tag}.${packet.content}.${packet.version}`, 'utf-8');
+        const sig = Buffer.from(packet.signature, 'base64url');
         const ok = crypto.verify(null, payload, crypto.createPublicKey(publicKeyPem), sig);
         if (!ok)
-            return { ok: false, message: "invalid_signature" };
+            return { ok: false, message: 'invalid_signature' };
         return { ok: true };
     }
     catch (err) {
@@ -96,15 +98,15 @@ function verifySignatureIfConfigured(packet) {
     }
 }
 function listRunFiles(storageDir) {
-    const dir = path.join(storageDir, "runs");
+    const dir = path.join(storageDir, 'runs');
     if (!fs.existsSync(dir))
         return [];
-    return fs.readdirSync(dir).filter((f) => f.endsWith(".json"));
+    return fs.readdirSync(dir).filter(f => f.endsWith('.json'));
 }
 function loadRunPacket(storageDir, runId) {
-    const file = path.join(storageDir, "runs", `${runId}.json`);
+    const file = path.join(storageDir, 'runs', `${runId}.json`);
     try {
-        const raw = fs.readFileSync(file, "utf-8");
+        const raw = fs.readFileSync(file, 'utf-8');
         return JSON.parse(raw);
     }
     catch {
@@ -112,117 +114,128 @@ function loadRunPacket(storageDir, runId) {
     }
 }
 function saveRunPacket(storageDir, packet) {
-    ensureDir(path.join(storageDir, "runs"));
-    const file = path.join(storageDir, "runs", `${packet.metadata.run_id}.json`);
-    fs.writeFileSync(file, JSON.stringify(packet, null, 2), "utf-8");
+    ensureDir(path.join(storageDir, 'runs'));
+    const file = path.join(storageDir, 'runs', `${packet.metadata.run_id}.json`);
+    fs.writeFileSync(file, JSON.stringify(packet, null, 2), 'utf-8');
 }
-export function startDashboardServer(opts = {}) {
-    const host = opts.host ?? "127.0.0.1";
-    const port = opts.port ?? Number(process.env.VIBE_DASHBOARD_PORT || 8787);
+const MAX_PORT_RETRIES = 3;
+export async function startDashboardServer(opts = {}) {
+    const host = opts.host ?? '127.0.0.1';
+    const basePort = opts.port ?? Number(process.env.VIBE_DASHBOARD_PORT || 8787);
     const storageDir = opts.storageDir ?? process.env.VIBE_DASHBOARD_DIR ?? DEFAULT_STORAGE_DIR;
     const authToken = opts.authToken ?? (process.env.VIBE_CLOUD_SYNC_TOKEN || null);
     const secretKey = opts.secretKey ?? authToken;
     const maxBodyBytes = opts.maxBodyBytes ?? 1_000_000;
     ensureDir(storageDir);
-    ensureDir(path.join(storageDir, "runs"));
+    ensureDir(path.join(storageDir, 'runs'));
     const builder = new SyncPacketBuilder();
+    // Signal stream setup
+    const workspaceRoot = opts.workspaceRoot ?? process.env.VIBE_WORKSPACE_ROOT ?? process.cwd();
+    const signalsDir = path.join(workspaceRoot, '.vibe', 'signals');
+    const signalStream = createSignalStreamHandler(signalsDir);
     // K8s health probe handlers
     const handleLiveness = createLivenessHandler({
         version: process.env.npm_package_version,
-        component: "dashboard",
+        component: 'dashboard',
     });
-    const handleReadiness = createReadinessHandler([
-        serverRunningChecker(),
-    ]);
+    const handleReadiness = createReadinessHandler([serverRunningChecker()]);
     const server = http.createServer(async (req, res) => {
         // CORS preflight (minimal)
-        if (req.method === "OPTIONS") {
+        if (req.method === 'OPTIONS') {
             res.statusCode = 204;
-            res.setHeader("Access-Control-Allow-Origin", "*");
-            res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-            res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+            res.setHeader('Access-Control-Allow-Origin', '*');
+            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
             res.end();
             return;
         }
-        const url = new URL(req.url ?? "/", `http://${req.headers.host || "localhost"}`);
+        const url = new URL(req.url ?? '/', `http://${req.headers.host || 'localhost'}`);
         // K8s liveness probe
-        if (req.method === "GET" && url.pathname === "/healthz") {
+        if (req.method === 'GET' && url.pathname === '/healthz') {
             handleLiveness(req, res);
             return;
         }
         // K8s readiness probe
-        if (req.method === "GET" && url.pathname === "/readyz") {
+        if (req.method === 'GET' && url.pathname === '/readyz') {
             await handleReadiness(req, res);
             return;
         }
         // Legacy health check
-        if (req.method === "GET" && url.pathname === "/api/v1/health") {
+        if (req.method === 'GET' && url.pathname === '/api/v1/health') {
             sendJson(res, 200, { ok: true });
             return;
         }
-        if (req.method === "POST" && url.pathname === "/api/v1/sync") {
+        if (req.method === 'POST' && url.pathname === '/api/v1/sync') {
             try {
                 const bearer = parseBearerToken(req);
                 if (authToken && bearer !== authToken) {
-                    sendJson(res, 401, { ok: false, error: "unauthorized" });
+                    sendJson(res, 401, { ok: false, error: 'unauthorized' });
                     return;
                 }
                 const body = await readRequestBody(req, maxBodyBytes);
                 const raw = JSON.parse(body);
                 const encrypted = raw;
-                if (!encrypted || typeof encrypted !== "object") {
-                    sendJson(res, 400, { ok: false, error: "invalid_json" });
+                if (!encrypted || typeof encrypted !== 'object') {
+                    sendJson(res, 400, { ok: false, error: 'invalid_json' });
                     return;
                 }
-                if (!encrypted.run_id || !encrypted.iv || !encrypted.tag || !encrypted.content || !encrypted.version) {
-                    sendJson(res, 400, { ok: false, error: "invalid_encrypted_packet" });
+                if (!encrypted.run_id ||
+                    !encrypted.iv ||
+                    !encrypted.tag ||
+                    !encrypted.content ||
+                    !encrypted.version) {
+                    sendJson(res, 400, { ok: false, error: 'invalid_encrypted_packet' });
                     return;
                 }
                 const sigCheck = verifySignatureIfConfigured(encrypted);
                 if (!sigCheck.ok) {
-                    sendJson(res, 400, { ok: false, error: "signature_invalid", message: sigCheck.message });
+                    sendJson(res, 400, { ok: false, error: 'signature_invalid', message: sigCheck.message });
                     return;
                 }
-                const key = (secretKey || bearer || "").trim();
+                const key = (secretKey || bearer || '').trim();
                 if (!key) {
-                    sendJson(res, 400, { ok: false, error: "missing_secret_key" });
+                    sendJson(res, 400, { ok: false, error: 'missing_secret_key' });
                     return;
                 }
                 const packet = builder.decrypt(encrypted, key);
                 saveRunPacket(storageDir, packet);
-                sendJson(res, 200, { ok: true, run_id: packet.metadata.run_id, received_at: new Date().toISOString() });
+                sendJson(res, 200, {
+                    ok: true,
+                    run_id: packet.metadata.run_id,
+                    received_at: new Date().toISOString(),
+                });
                 return;
             }
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
-                sendJson(res, 500, { ok: false, error: "sync_failed", message: msg });
+                sendJson(res, 500, { ok: false, error: 'sync_failed', message: msg });
                 return;
             }
         }
-        if (req.method === "GET" && url.pathname === "/api/v1/runs") {
+        if (req.method === 'GET' && url.pathname === '/api/v1/runs') {
             const runs = listRunFiles(storageDir)
-                .map((f) => f.replace(/\.json$/, ""))
+                .map(f => f.replace(/\.json$/, ''))
                 .sort();
             sendJson(res, 200, { runs });
             return;
         }
-        if (req.method === "GET" && url.pathname.startsWith("/api/v1/runs/")) {
-            const runId = decodeURIComponent(url.pathname.split("/").slice(-1)[0] || "");
+        if (req.method === 'GET' && url.pathname.startsWith('/api/v1/runs/')) {
+            const runId = decodeURIComponent(url.pathname.split('/').slice(-1)[0] || '');
             const pkt = loadRunPacket(storageDir, runId);
             if (!pkt) {
-                sendJson(res, 404, { ok: false, error: "not_found" });
+                sendJson(res, 404, { ok: false, error: 'not_found' });
                 return;
             }
             sendJson(res, 200, pkt);
             return;
         }
-        if (req.method === "GET" && url.pathname === "/api/v1/stats/roi") {
+        if (req.method === 'GET' && url.pathname === '/api/v1/stats/roi') {
             const files = listRunFiles(storageDir);
             let tokensSaved = 0;
             let inputTokens = 0;
             let outputTokens = 0;
             for (const f of files) {
-                const runId = f.replace(/\.json$/, "");
+                const runId = f.replace(/\.json$/, '');
                 const pkt = loadRunPacket(storageDir, runId);
                 if (!pkt)
                     continue;
@@ -235,7 +248,7 @@ export function startDashboardServer(opts = {}) {
             }
             const dollarSaved = (tokensSaved / 1000) * 0.015;
             sendJson(res, 200, {
-                period: "all",
+                period: 'all',
                 total_runs: files.length,
                 metrics: {
                     tokens_saved: tokensSaved,
@@ -249,43 +262,43 @@ export function startDashboardServer(opts = {}) {
                     },
                 },
                 comparison: {
-                    vs_last_month: "n/a",
-                    vs_last_quarter: "n/a",
+                    vs_last_month: 'n/a',
+                    vs_last_quarter: 'n/a',
                 },
             });
             return;
         }
-        if (req.method === "GET" && url.pathname === "/api/v1/stats/safety") {
+        if (req.method === 'GET' && url.pathname === '/api/v1/stats/safety') {
             const files = listRunFiles(storageDir);
             const counts = { GO: 0, FIX: 0, BLOCK: 0 };
             for (const f of files) {
-                const runId = f.replace(/\.json$/, "");
+                const runId = f.replace(/\.json$/, '');
                 const pkt = loadRunPacket(storageDir, runId);
                 const v = pkt?.verdict_summary?.final_verdict;
-                if (v === "GO" || v === "FIX" || v === "BLOCK")
+                if (v === 'GO' || v === 'FIX' || v === 'BLOCK')
                     counts[v]++;
             }
             const total = files.length || 0;
             const passRate = total > 0 ? counts.GO / total : 0;
             sendJson(res, 200, {
-                period: "all",
+                period: 'all',
                 total_runs: total,
                 verdicts: counts,
                 pass_rate: Number((passRate * 100).toFixed(2)),
-                trend: "unknown",
+                trend: 'unknown',
             });
             return;
         }
-        if (req.method === "GET" && url.pathname === "/api/v1/stats/violations") {
+        if (req.method === 'GET' && url.pathname === '/api/v1/stats/violations') {
             const files = listRunFiles(storageDir);
             const counts = {};
             for (const f of files) {
-                const runId = f.replace(/\.json$/, "");
+                const runId = f.replace(/\.json$/, '');
                 const pkt = loadRunPacket(storageDir, runId);
                 if (!pkt)
                     continue;
                 for (const v of pkt.violation_details ?? []) {
-                    const key = String(v.type || "UNKNOWN");
+                    const key = String(v.type || 'UNKNOWN');
                     counts[key] = (counts[key] ?? 0) + 1;
                 }
             }
@@ -298,32 +311,74 @@ export function startDashboardServer(opts = {}) {
                 percentage: totalViolations > 0 ? Math.round((count / totalViolations) * 100) : 0,
             }));
             sendJson(res, 200, {
-                period: "all",
+                period: 'all',
                 total_violations: totalViolations,
                 by_type: byType,
-                trend: "unknown",
+                trend: 'unknown',
             });
             return;
         }
-        if (req.method === "GET" && url.pathname === "/api/v1/license") {
+        if (req.method === 'GET' && url.pathname === '/api/v1/license') {
             const bearer = parseBearerToken(req);
             const ok = authToken ? bearer === authToken : true;
             sendJson(res, 200, {
                 ok,
                 auth_required: Boolean(authToken),
-                plan: authToken ? "PRO" : "ALL",
+                plan: authToken ? 'PRO' : 'ALL',
             });
             return;
         }
-        sendText(res, 404, "Not Found");
+        // SSE signal stream
+        if (req.method === 'GET' && url.pathname === '/api/v1/signals/stream') {
+            signalStream.handler(req, res);
+            return;
+        }
+        // Scout Monitor HTML page
+        if (req.method === 'GET' && (url.pathname === '/monitor' || url.pathname === '/monitor/')) {
+            sendMonitorPage(res);
+            return;
+        }
+        sendText(res, 404, 'Not Found');
     });
-    server.listen(port, host);
-    const url = `http://${host}:${port}`;
+    // Try binding with port retry on EADDRINUSE
+    let boundPort = basePort;
+    for (let attempt = 0; attempt <= MAX_PORT_RETRIES; attempt++) {
+        const tryPort = basePort + attempt;
+        try {
+            await new Promise((resolve, reject) => {
+                const onError = (err) => {
+                    server.removeListener('listening', onListening);
+                    reject(err);
+                };
+                const onListening = () => {
+                    server.removeListener('error', onError);
+                    resolve();
+                };
+                server.once('error', onError);
+                server.once('listening', onListening);
+                server.listen(tryPort, host);
+            });
+            boundPort = tryPort;
+            break;
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === 'EADDRINUSE' && attempt < MAX_PORT_RETRIES) {
+                logger.error(`[Dashboard] Port ${tryPort} in use, trying ${tryPort + 1}...`);
+                // Close before retrying (listen can only be called once without close)
+                await new Promise(r => server.close(() => r()));
+                continue;
+            }
+            throw err;
+        }
+    }
+    const url = `http://${host}:${boundPort}`;
     return {
         server,
         url,
         close: () => new Promise((resolve, reject) => {
-            server.close((err) => {
+            signalStream.cleanup();
+            server.close(err => {
                 if (err)
                     reject(err);
                 else
@@ -332,3 +387,102 @@ export function startDashboardServer(opts = {}) {
         }),
     };
 }
+// ============================================================================
+// Scout Monitor HTML Page
+// ============================================================================
+function sendMonitorPage(res) {
+    const html = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width,initial-scale=1.0">
+<title>Scout Monitor</title>
+<style>
+*{box-sizing:border-box;margin:0;padding:0}
+body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:#0f1117;color:#e1e4e8;padding:24px}
+header{display:flex;align-items:center;gap:12px;margin-bottom:24px}
+header h1{font-size:20px;font-weight:600}
+#status{display:inline-block;width:10px;height:10px;border-radius:50%;background:#f85149}
+#status.connected{background:#3fb950}
+#stats{display:flex;gap:16px;margin-bottom:24px;flex-wrap:wrap}
+.sc{background:#161b22;border:1px solid #30363d;border-radius:8px;padding:16px 20px;min-width:140px}
+.sc .l{font-size:12px;color:#8b949e;text-transform:uppercase}
+.sc .v{font-size:28px;font-weight:700;margin-top:4px}
+#events{display:flex;flex-direction:column;gap:12px}
+.card{background:#161b22;border:1px solid #30363d;border-radius:8px;padding:16px;animation:si .3s ease}
+@keyframes si{from{opacity:0;transform:translateY(-8px)}to{opacity:1;transform:translateY(0)}}
+.card-h{display:flex;align-items:center;gap:8px;margin-bottom:8px}
+.badge{display:inline-block;padding:2px 8px;border-radius:12px;font-size:11px;font-weight:600;text-transform:uppercase}
+.b-t3{background:#da3633;color:#fff}.b-t6{background:#d29922;color:#fff}.b-t8{background:#1f6feb;color:#fff}.b-u{background:#30363d;color:#8b949e}
+.r-high{color:#f85149}.r-medium{color:#d29922}.r-low{color:#3fb950}
+.analysis{font-size:14px;line-height:1.5;margin-bottom:8px;color:#c9d1d9}
+.sug{list-style:none;padding:0}
+.sug li{font-size:13px;color:#8b949e;padding:2px 0}
+.sug li::before{content:"\\2192 ";color:#58a6ff}
+.meta{display:flex;gap:16px;margin-top:8px;font-size:12px;color:#484f58;flex-wrap:wrap}
+.meta span{display:flex;align-items:center;gap:4px}
+.cbar{display:inline-block;width:60px;height:6px;background:#21262d;border-radius:3px;overflow:hidden}
+.cfill{height:100%;border-radius:3px;background:#58a6ff}
+#empty{text-align:center;padding:80px 0;color:#484f58}
+#empty p{font-size:16px;margin-top:8px}
+</style>
+</head>
+<body>
+<header>
+  <div id="status"></div>
+  <h1>Scout Monitor</h1>
+  <span id="conn" style="font-size:12px;color:#484f58">Connecting...</span>
+</header>
+<div id="stats">
+  <div class="sc"><div class="l">Events</div><div class="v" id="c-total">0</div></div>
+  <div class="sc"><div class="l">High Risk</div><div class="v r-high" id="c-high">0</div></div>
+  <div class="sc"><div class="l">Medium Risk</div><div class="v r-medium" id="c-med">0</div></div>
+  <div class="sc"><div class="l">Low Risk</div><div class="v r-low" id="c-low">0</div></div>
+</div>
+<div id="events">
+  <div id="empty"><p>Waiting for scout events...</p><p style="font-size:13px;margin-top:4px">Run a scout analysis to see results here</p></div>
+</div>
+<script>
+(function(){
+  var el=document.getElementById('events'),empty=document.getElementById('empty');
+  var st=document.getElementById('status'),cn=document.getElementById('conn');
+  var ct=document.getElementById('c-total'),ch=document.getElementById('c-high');
+  var cm=document.getElementById('c-med'),cl=document.getElementById('c-low');
+  var counts={t:0,h:0,m:0,l:0};
+  function upd(r){counts.t++;if(r==='high')counts.h++;else if(r==='medium')counts.m++;else counts.l++;ct.textContent=counts.t;ch.textContent=counts.h;cm.textContent=counts.m;cl.textContent=counts.l;}
+  function badge(s){s=(s||'').toUpperCase();if(s.includes('AUTH'))return'<span class="badge b-t3">T3 Auth</span>';if(s.includes('DEP'))return'<span class="badge b-t6">T6 Dep</span>';if(s.includes('GATE'))return'<span class="badge b-t8">T8 Gate</span>';return'<span class="badge b-u">'+(s||'unknown')+'</span>';}
+  function esc(s){var d=document.createElement('div');d.textContent=s;return d.innerHTML;}
+  function render(sig){
+    var m=sig.metadata||{},r=m.risk_level||'low',c=m.confidence||0;
+    upd(r);
+    if(empty&&empty.parentNode)empty.remove();empty=null;
+    var card=document.createElement('div');card.className='card';
+    var ts=new Date(sig.timestamp).toLocaleTimeString();
+    var shtml='';
+    if(m.suggestions&&m.suggestions.length>0){shtml='<ul class="sug">'+m.suggestions.map(function(s){return'<li>'+esc(s)+'</li>';}).join('')+'</ul>';}
+    card.innerHTML='<div class="card-h">'+badge(m.scenario)+'<span class="r-'+r+'" style="font-weight:600;font-size:13px">'+r.toUpperCase()+' RISK</span>'+(m.source_type==='heuristic'?'<span style="font-size:11px;color:#8b949e">[heuristic]</span>':'')+'</div>'
+      +'<div class="analysis">'+esc(m.analysis||'No analysis text')+'</div>'+shtml
+      +'<div class="meta"><span>'+ts+'</span><span>Confidence: <span class="cbar"><span class="cfill" style="width:'+Math.round(c*100)+'%"></span></span> '+Math.round(c*100)+'%</span>'
+      +(m.latency_ms?'<span>'+m.latency_ms+'ms</span>':'')
+      +(sig.block_id?'<span>Block: '+esc(sig.block_id.slice(0,12))+'...</span>':'')+'</div>';
+    el.insertBefore(card,el.firstChild);
+    while(el.children.length>50)el.removeChild(el.lastChild);
+  }
+  function connect(){
+    var es=new EventSource('/api/v1/signals/stream');
+    es.onopen=function(){st.className='connected';cn.textContent='Connected';};
+    es.onmessage=function(e){try{var sig=JSON.parse(e.data);if(sig.kind==='swarm_inference')render(sig);}catch(x){console.warn('signal parse failed',x);}};
+    es.onerror=function(){st.className='';cn.textContent='Reconnecting...';es.close();setTimeout(connect,3000);};
+  }
+  connect();
+})();
+</script>
+</body>
+</html>`;
+    res.writeHead(200, {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Cache-Control': 'no-cache',
+        'Access-Control-Allow-Origin': '*',
+    });
+    res.end(html);
+}

package/build/dashboard/signal_stream.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Signal Stream SSE Handler
+ *
+ * Tails .vibe/signals/*.jsonl files and streams new signals
+ * to connected SSE clients in real-time.
+ *
+ * Design:
+ *   - 500ms polling (reliable on WSL2, unlike fs.watch)
+ *   - Byte offset tracking per file (no re-reading)
+ *   - Auto-stop when no clients connected
+ *   - Initial burst of recent 20 signals on connect
+ *
+ * @since v1.8.0
+ */
+import * as http from 'node:http';
+/**
+ * Create an SSE signal stream handler for the given signals directory.
+ * Optionally also polls an observer signals file for unified streaming.
+ */
+export declare function createSignalStreamHandler(signalsDir: string, observerSignalsPath?: string): {
+    handler: (req: http.IncomingMessage, res: http.ServerResponse) => void;
+    cleanup: () => void;
+    getClientCount: () => number;
+};