@zaip-ai/cli 2.2.0 → 2.6.0

package/templates/.agents/dashboard/packages/local-runtime/src/server-snapshot.test.ts

@@ -45,7 +45,7 @@ describe("dashboard backend snapshot", () => {
       [
         "lock_version: 1",
         "framework:",
-        "  version: 2.2.0",
+        "  version: 2.5.0",
         "  distribution_sha256: null",
         "layout:",
         "  version: 3",
@@ -357,7 +357,9 @@ describe("dashboard backend snapshot", () => {
     );
 
     try {
-      const app = createDashboardApp(fixtureRoot, "test-session");
+      const app = createDashboardApp(fixtureRoot, "test-session", undefined, {
+        reconcileOpenWork: async () => ({ reconciled_ids: [], blocked: [], not_reconciled: [] }),
+      });
       const allCosts = await app.request("/api/v2/cost-monitor?currency=BRL", {
         headers: { "x-zaip-session": "test-session" },
       });
@@ -448,7 +450,9 @@ describe("dashboard backend snapshot", () => {
           };
         };
       };
-      const julyOperationsPayload = (await julyOperations.json()) as { runs: OperationRunMetric[] };
+      const _julyOperationsPayload = (await julyOperations.json()) as {
+        runs: OperationRunMetric[];
+      };
       const allCostsPayload = (await allCosts.json()) as CostSummaryPayload;
       const julyCostsPayload = (await monthlyCosts.json()) as CostSummaryPayload;
       expect(allCostsPayload).toMatchObject({ readonly: true, aggregate_only: true });
@@ -456,7 +460,7 @@ describe("dashboard backend snapshot", () => {
       const portableAllCostsPayload = (await portableAllCosts.json()) as CostSummaryPayload;
       const portableJulyCostsPayload = (await portableJulyCosts.json()) as CostSummaryPayload;
       const quickOperationsPayload = (await quickOperations.json()) as QuickOperationsPayload;
-      const runIds = (rows: readonly { id: string }[] | readonly { run_id: string }[]) =>
+      const _runIds = (rows: readonly { id: string }[] | readonly { run_id: string }[]) =>
         rows.map((row) => ("id" in row ? row.id : row.run_id)).sort();
       // scope=summary is intentionally aggregate-only: no Run/Sub-Run payload
       // is loaded or returned.  Detail parity remains covered by Operations.
@@ -480,13 +484,13 @@ describe("dashboard backend snapshot", () => {
         expect(cost, `missing Cost bucket ${day}`).toBeDefined();
         expect(period.usage.cost.known_sum, `Operations cost ${day}`).toBeGreaterThan(0);
         expect(period.duration?.known_sum, `Operations duration ${day}`).toBeGreaterThan(0);
-        expect(cost!.estimated_brl, `Cost cost ${day}`).toBeGreaterThan(0);
-        expect(cost!.duration_ms, `Cost duration ${day}`).toBeGreaterThan(0);
-        expect(period.usage.total_tokens.known_sum).toBe(cost!.total_tokens);
-        expect(period.usage.cost.known_sum).toBe(cost!.estimated_brl);
-        expect(period.duration?.known_sum).toBe(cost!.duration_ms);
+        expect(cost?.estimated_brl, `Cost cost ${day}`).toBeGreaterThan(0);
+        expect(cost?.duration_ms, `Cost duration ${day}`).toBeGreaterThan(0);
+        expect(period.usage.total_tokens.known_sum).toBe(cost?.total_tokens);
+        expect(period.usage.cost.known_sum).toBe(cost?.estimated_brl);
+        expect(period.duration?.known_sum).toBe(cost?.duration_ms);
       }
-      const rootOperations = allOperationsPayload.runs.find(
+      const _rootOperations = allOperationsPayload.runs.find(
         (run) => run.id === "RUN-2026-07-14-00-00-DASHBOARD-FIXTURE-A1B2",
       );
       expect(
@@ -520,6 +524,8 @@ describe("dashboard backend snapshot", () => {
         },
         projection: {
           source_latest_at: "2026-07-14T00:00:05.000Z",
+          updated_at: null,
+          latest_token_collected_at: null,
           served_at: expect.any(String),
         },
       });
@@ -567,7 +573,7 @@ describe("dashboard backend snapshot", () => {
 
 describe("Cost Monitor daily summary route", () => {
   it("does not route summary requests through summary.json, snapshots, or Run transport", () => {
-    const source = readFileSync(new URL("./server.ts", import.meta.url), "utf8");
+    const source = readFileSync(new URL("./server-costs-routes.ts", import.meta.url), "utf8");
     const start = source.indexOf('if (scope === "summary")');
     const end = source.indexOf('if (scope === "runs")', start);
     const summaryRoute = source.slice(start, end);
@@ -580,9 +586,9 @@ describe("Cost Monitor daily summary route", () => {
   });
 
   it("uses only the bounded SQL aggregate for the Cost first fold", () => {
-    const source = readFileSync(new URL("./server.ts", import.meta.url), "utf8");
+    const source = readFileSync(new URL("./server-read-projections.ts", import.meta.url), "utf8");
     const start = source.indexOf("async function firstFoldCostSource(");
-    const end = source.indexOf("export function createDashboardApp(", start);
+    const end = source.indexOf("export async function dashboardSnapshot(", start);
     expect(start).toBeGreaterThanOrEqual(0);
     expect(end).toBeGreaterThan(start);
     const firstFoldCostSource = source.slice(start, end);
@@ -593,14 +599,9 @@ describe("Cost Monitor daily summary route", () => {
   });
 
   it("keeps the Daily first-fold response to its displayed-column allowlist", () => {
-    const source = readFileSync(new URL("./sqlite-read-model.ts", import.meta.url), "utf8");
-    const dailyBranch = source.slice(
-      source.indexOf(
-        "if (filteredCostGroup !== undefined && temporalCostGroup && !hasDimensionalCostFilter)",
-      ),
-      source.indexOf(
-        "if (filteredCostGroup !== undefined && (!temporalCostGroup || hasDimensionalCostFilter))",
-      ),
+    const dailyBranch = readFileSync(
+      new URL("./sqlite-query-temporal-dimension.ts", import.meta.url),
+      "utf8",
     );
     expect(dailyBranch).not.toContain("costMonitorFactualDurationByDay(");
     expect(dailyBranch).toContain("Daily first fold is an allowlisted table contract");

package/templates/.agents/dashboard/packages/local-runtime/src/server-sqlite-view-allowlist.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it, vi } from "vitest";
+import { createDashboardApp } from "./server.js";
+import { withSqliteReadModelFixture } from "./server.test-fixtures.js";
+
+describe("SQLite view HTTP allowlist", () => {
+  it("rejects inherited object names before invoking SQLite and accepts an owned view", async () => {
+    await withSqliteReadModelFixture("view-allowlist", async ({ root, filesystem }) => {
+      const viewPage = vi.spyOn(filesystem, "viewPage");
+      const app = createDashboardApp(root, "test-session", undefined, { filesystem });
+      for (const view of ["constructor", "toString", "__proto__"]) {
+        const response = await app.request(`/api/v2/sqlite-views?view=${view}`, {
+          headers: { "x-zaip-session": "test-session" },
+        });
+        expect(response.status).toBe(400);
+        await expect(response.json()).resolves.toEqual({ error: "Unsupported SQLite view" });
+      }
+      expect(viewPage).not.toHaveBeenCalled();
+      const response = await app.request("/api/v2/sqlite-views?view=first_fold_top_tasks", {
+        headers: { "x-zaip-session": "test-session" },
+      });
+      expect(response.status, await response.clone().text()).toBe(200);
+      expect(viewPage).toHaveBeenCalledWith("first_fold_top_tasks", expect.any(Object));
+    });
+  });
+});

package/templates/.agents/dashboard/packages/local-runtime/src/server-trace-routes.ts

@@ -0,0 +1,64 @@
+import {
+  readPrdDetail,
+  readSpecDetail,
+  readTaskDetail,
+} from "@zaip-ai/dashboard-operations/server";
+import { buildTaskTrace } from "@zaip-ai/dashboard-traceability/server";
+import type { Hono } from "hono";
+import { API_PREFIX, headOrJson, V2WorkspaceRequiredError } from "./server-http-contracts.js";
+import type { DashboardRouteContext } from "./server-route-context.js";
+import { buildSqliteTaskTrace } from "./server-sqlite-task-trace.js";
+import { SqliteReadModelFileSystem } from "./sqlite-read-model.js";
+export function registerTraceRoutes(app: Hono, dependencies: DashboardRouteContext) {
+  const {
+    filesystem,
+    canonicalFilesystem,
+    isSqliteSnapshot,
+    readLayout,
+    readSnapshot,
+    readAggregate,
+    clearSnapshotCache,
+  } = dependencies;
+  app.on(["GET", "HEAD"], `${API_PREFIX}/tasks/:id`, async (context) => {
+    try {
+      const layout = await readLayout();
+      return headOrJson(context, await readTaskDetail(filesystem, layout, context.req.param("id")));
+    } catch (error) {
+      if (error instanceof V2WorkspaceRequiredError) throw error;
+      return headOrJson(context, { error: "Task not found" }, 404);
+    }
+  });
+  app.on(["GET", "HEAD"], `${API_PREFIX}/prds/:id`, async (context) => {
+    try {
+      const layout = await readLayout();
+      return headOrJson(context, await readPrdDetail(filesystem, layout, context.req.param("id")));
+    } catch (error) {
+      if (error instanceof V2WorkspaceRequiredError) throw error;
+      return headOrJson(context, { error: "PRD not found" }, 404);
+    }
+  });
+  app.on(["GET", "HEAD"], `${API_PREFIX}/specs/:id`, async (context) => {
+    try {
+      const layout = await readLayout();
+      return headOrJson(context, await readSpecDetail(filesystem, layout, context.req.param("id")));
+    } catch (error) {
+      if (error instanceof V2WorkspaceRequiredError) throw error;
+      return headOrJson(context, { error: "SPEC not found" }, 404);
+    }
+  });
+  app.on(["GET", "HEAD"], `${API_PREFIX}/tasks/:id/trace`, async (context) => {
+    try {
+      const layout = await readLayout();
+      const taskId = context.req.param("id");
+      return headOrJson(
+        context,
+        filesystem instanceof SqliteReadModelFileSystem
+          ? buildSqliteTaskTrace(filesystem, layout, taskId)
+          : await buildTaskTrace(filesystem, layout, taskId),
+      );
+    } catch (error) {
+      if (error instanceof V2WorkspaceRequiredError) throw error;
+      return headOrJson(context, { error: "Task trace not found" }, 404);
+    }
+  });
+}

package/templates/.agents/dashboard/packages/local-runtime/src/server-work-reconciliation.test.ts

@@ -1,7 +1,6 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   createWorkReconciliation,
-  startHostTerminalReconciliation,
   waitForWorkReconciliation,
 } from "./server-work-reconciliation.js";
 import { type ReconciliationResult, reconciliationCommandTimeoutMs } from "./server-workspace.js";
@@ -14,7 +13,7 @@ const changed: ReconciliationResult = {
 afterEach(() => vi.useRealTimers());
 
 describe("canonical host recovery", () => {
-  it("serializes manual recovery after host-only work and deduplicates concurrent clicks", async () => {
+  it("queues manual recovery after host-only work and deduplicates concurrent clicks", async () => {
     let release!: (value: ReconciliationResult) => void;
     const first = new Promise<ReconciliationResult>((resolve) => {
       release = resolve;
@@ -26,7 +25,7 @@ describe("canonical host recovery", () => {
     await Promise.resolve();
     const manual = run("manual");
     expect(run("manual")).toBe(manual);
-    expect(run("host-terminal")).toBe(manual);
+    expect(run("host-terminal")).toBe(automatic);
     expect(reconcile.mock.calls).toEqual([["host-terminal"]]);
     release(clean);
     await automatic;
@@ -47,33 +46,6 @@ describe("canonical host recovery", () => {
     expect(refresh).toHaveBeenCalledOnce();
   });
 
-  it("recovers at startup and retries after failure without overlapping work", async () => {
-    vi.useFakeTimers();
-    let release!: () => void;
-    const reconcile = vi
-      .fn()
-      .mockImplementationOnce(
-        () =>
-          new Promise<void>((resolve) => {
-            release = resolve;
-          }),
-      )
-      .mockRejectedValueOnce(new Error("busy"))
-      .mockResolvedValue(undefined);
-    const stop = startHostTerminalReconciliation(reconcile);
-    await vi.advanceTimersByTimeAsync(1_000);
-    await vi.advanceTimersByTimeAsync(90_000);
-    expect(reconcile).toHaveBeenCalledOnce();
-    release();
-    await vi.advanceTimersByTimeAsync(30_000);
-    expect(reconcile).toHaveBeenCalledTimes(2);
-    await vi.advanceTimersByTimeAsync(30_000);
-    expect(reconcile).toHaveBeenCalledTimes(3);
-    stop();
-    await vi.advanceTimersByTimeAsync(60_000);
-    expect(reconcile).toHaveBeenCalledTimes(3);
-  });
-
   it("bounds total request time even while the canonical writer is queued", async () => {
     vi.useFakeTimers();
     let release!: (value: ReconciliationResult) => void;

package/templates/.agents/dashboard/packages/local-runtime/src/server-work-reconciliation.ts

@@ -32,7 +32,7 @@ export async function waitForWorkReconciliation(
   }
 }
 
-/** Serialize canonical mutations from the button and the host recovery timer. */
+/** Serialize canonical mutations from the button and the one-shot host recovery. */
 export function createWorkReconciliation(input: {
   reconcile: (mode: ReconciliationMode) => Promise<ReconciliationResult>;
   refresh: () => Promise<void>;
@@ -41,7 +41,11 @@ export function createWorkReconciliation(input: {
   const pending = new Map<ReconciliationMode, Promise<ReconciliationResult>>();
   const refresh = () => void input.refresh().catch(() => undefined);
   return (mode: ReconciliationMode): Promise<ReconciliationResult> => {
-    const current = pending.get("manual") ?? pending.get(mode);
+    // A manual command is an explicit operator action. It may wait for an
+    // already-writing command, but it must never be represented by the host
+    // recovery promise: that made the dialog appear to run forever while the
+    // timer continued scheduling work behind it.
+    const current = pending.get(mode);
     if (current !== undefined) return current;
     const job = tail
       .then(() => input.reconcile(mode))
@@ -65,24 +69,3 @@ export function createWorkReconciliation(input: {
     return job;
   };
 }
-
-/** Recover missed host-stop callbacks without relying on an open browser tab. */
-export function startHostTerminalReconciliation(reconcile: () => Promise<unknown>): () => void {
-  let stopped = false;
-  let timer: ReturnType<typeof setTimeout>;
-  const schedule = (delay: number) => {
-    timer = setTimeout(() => {
-      void reconcile()
-        .catch(() => undefined)
-        .finally(() => {
-          if (!stopped) schedule(30_000);
-        });
-    }, delay);
-    timer.unref();
-  };
-  schedule(1_000);
-  return () => {
-    stopped = true;
-    clearTimeout(timer);
-  };
-}

package/templates/.agents/dashboard/packages/local-runtime/src/server.test-fixtures.ts

@@ -20,7 +20,7 @@ export async function withSqliteReadModelFixture<T>(
     );
     await writeFile(
       join(root, ".agents", "config", "framework.lock.yaml"),
-      "lock_version: 1\nframework:\n  version: 2.2.0\n  distribution_sha256: null\nlayout:\n  version: 3\nresolved_profile:\n  id: null\n  sha256: null\nmanaged_files: {}\n",
+      "lock_version: 1\nframework:\n  version: 2.5.0\n  distribution_sha256: null\nlayout:\n  version: 3\nresolved_profile:\n  id: null\n  sha256: null\nmanaged_files: {}\n",
     );
     await rebuildSqliteReadModel(root);
     filesystem = new SqliteReadModelFileSystem(root);