@zaip-ai/cli 2.6.0 → 3.1.0

package/templates/.agents/dashboard/scripts/qualify-observability.mjs

@@ -0,0 +1,130 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { access, mkdir, readdir, readFile, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+
+const root = resolve(import.meta.dirname, "../../..");
+const mode = process.argv[2];
+assert(["test", "integration", "check"].includes(mode), "Expected test|integration|check");
+const exec = promisify(execFile);
+async function run(args, timeout = 180_000, cwd = root) {
+  const result = await exec(process.execPath, args, {
+    cwd,
+    timeout,
+    windowsHide: true,
+    maxBuffer: 8 * 1024 * 1024,
+    env: { ...process.env, CI: "true" },
+  });
+  process.stdout.write(result.stdout);
+  process.stderr.write(result.stderr);
+}
+// Fail structural violations before installing dependencies or compiling fixtures.
+if (mode === "test") await run([join(root, "scripts/validate-source-size.mjs")]);
+if (
+  !(await access(join(root, "node_modules/vitest/vitest.mjs")).then(
+    () => true,
+    () => false,
+  ))
+) {
+  await run([
+    join(dirname(process.execPath), "node_modules/corepack/dist/pnpm.js"),
+    "install",
+    "--offline",
+    "--frozen-lockfile",
+    "--ignore-scripts",
+  ]);
+}
+const require = createRequire(join(root, "package.json"));
+const { build } = require("esbuild");
+const alias = {};
+for (const name of await readdir(join(root, "packages"))) {
+  const manifest = join(root, "packages", name, "package.json");
+  if (
+    !(await access(manifest).then(
+      () => true,
+      () => false,
+    ))
+  )
+    continue;
+  const pkg = JSON.parse(await readFile(manifest, "utf8"));
+  if (typeof pkg.exports?.["."] === "string")
+    alias[pkg.name] = join(dirname(manifest), pkg.exports["."]);
+}
+await build({
+  entryPoints: [join(root, "packages/cli/src/index.ts")],
+  outfile: join(root, "packages/cli/dist/index.js"),
+  alias,
+  bundle: true,
+  format: "esm",
+  platform: "node",
+  target: "node22",
+  minifyWhitespace: true,
+  banner: {
+    js: 'import { createRequire as __zaipCreateRequire } from "node:module"; const require = __zaipCreateRequire(import.meta.url);',
+  },
+});
+
+if (mode === "integration") {
+  await run([
+    join(root, ".agents/dashboard/packages/local-runtime/scripts/build-sqlite-dashboard.mjs"),
+  ]);
+  // Match the release text normalization before the candidate cleanliness check.
+  await run([
+    join(root, "scripts/normalize-generated-text.mjs"),
+    ".agents/dashboard/apps/frontend/dist",
+  ]);
+  const evidence =
+    process.argv[3] === undefined
+      ? join(root, ".local/qualification/observability")
+      : resolve(process.argv[3]);
+  await mkdir(evidence, { recursive: true });
+  await run([
+    join(root, ".agents/dashboard/scripts/verify-observability.mjs"),
+    "--evidence",
+    evidence,
+  ]);
+} else if (mode === "check") {
+  await run([join(root, ".agents/dashboard/scripts/verify-project-setup.mjs"), "check"]);
+  await run([
+    join(root, "node_modules/typescript/bin/tsc"),
+    "--noEmit",
+    "-p",
+    "packages/lifecycle-manifests/tsconfig.json",
+  ]);
+} else {
+  const configDirectory = join(root, ".local/qualification/observability-config");
+  await mkdir(configDirectory, { recursive: true });
+  const config = join(configDirectory, "vitest.config.mjs");
+  await writeFile(
+    config,
+    `import base from ${JSON.stringify(pathToFileURL(join(root, "vitest.config.ts")).href)};\nexport default {...base, resolve: {...base.resolve, alias: ${JSON.stringify(alias)}}};\n`,
+  );
+  await run([
+    join(root, "node_modules/vitest/vitest.mjs"),
+    "run",
+    "--config",
+    config,
+    "--maxWorkers=1",
+    "--testTimeout=60000",
+    "--hookTimeout=60000",
+    "packages/lifecycle-manifests/src/summary-metrics.test.ts",
+    "packages/cli/src/model-call-v3-integration.test.ts",
+    "packages/cli/src/run-finalization-barrier.test.ts",
+    "packages/cli/src/candidate-resolution.test.ts",
+    "packages/cli/src/run-lifecycle-closure.test.ts",
+    ".agents/dashboard/packages/local-runtime/start-dashboard.test.mjs",
+    ".agents/dashboard/packages/local-runtime/start-dashboard-launch-claims.test.mjs",
+    ".agents/dashboard/packages/local-runtime/start-dashboard-lifecycle.test.mjs",
+    ".agents/dashboard/packages/local-runtime/src/server-cross-layer-parity.test.ts",
+    ".agents/dashboard/packages/local-runtime/src/sqlite-read-model-marks-token-cost-telemetry-unavailable-when.test.ts",
+    ".agents/dashboard/apps/frontend/src/operations-detail-hydration.test.ts",
+    ".agents/dashboard/apps/frontend/src/dashboard-cost-facts.test.ts",
+    ".agents/dashboard/modules/operations/src/react/OperationsOverview.test.ts",
+    ".agents/dashboard/modules/cost-monitor/src/server/run-telemetry.test.ts",
+    "tests/e2e/traceability-contract.e2e.test.ts",
+  ]);
+}
+console.log(JSON.stringify({ mode, passed: true, platform: process.platform }));

package/templates/.agents/dashboard/scripts/verify-autonomy-settings.mjs

@@ -0,0 +1,175 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { join, resolve } from "node:path";
+import { createObservabilityFixture } from "../tests/observability-fixture.mjs";
+
+const repository = resolve(import.meta.dirname, "../../..");
+const runtimeRoot = join(repository, ".agents/dashboard/packages/local-runtime");
+const require = createRequire(join(runtimeRoot, "package.json"));
+const {
+  createDashboardApp,
+  rebuildSqliteReadModel,
+  SqliteReadModelFileSystem,
+} = require("./dist/server.cjs");
+const { serve } = require("@hono/node-server");
+const { chromium, expect } = require("@playwright/test");
+const testRoot = join(repository, ".local/sqlite/tests");
+const evidenceParent = join(repository, ".local/autonomy-maintenance");
+await mkdir(evidenceParent, { recursive: true });
+const evidenceRoot = await mkdtemp(join(evidenceParent, "ui-"));
+await mkdir(testRoot, { recursive: true });
+await mkdir(evidenceRoot, { recursive: true });
+const fixture = await mkdtemp(join(testRoot, "autonomy-settings-"));
+const token = "synthetic-autonomy-local-only";
+const report = {
+  synthetic: true,
+  platform: process.platform,
+  started_at: new Date().toISOString(),
+  candidate: "current uncommitted workspace builds; not release qualification",
+  evidence_directory: evidenceRoot,
+  checks: [],
+  passed: false,
+};
+let filesystem, server, browser, page;
+try {
+  await createObservabilityFixture(fixture);
+  await mkdir(join(fixture, ".agents/config/agents"), { recursive: true });
+  await cp(
+    join(repository, ".agents/config/agents/catalog.yaml"),
+    join(fixture, ".agents/config/agents/catalog.yaml"),
+  );
+  await rebuildSqliteReadModel(fixture, { forceCanonical: true });
+  filesystem = new SqliteReadModelFileSystem(fixture);
+  const frontend = join(repository, ".agents/dashboard/apps/frontend/dist");
+  report.frontend_index_sha256 = createHash("sha256")
+    .update(await readFile(join(frontend, "index.html")))
+    .digest("hex");
+  report.server_sha256 = createHash("sha256")
+    .update(await readFile(join(runtimeRoot, "dist/server.cjs")))
+    .digest("hex");
+  const app = createDashboardApp(fixture, token, frontend, {
+    filesystem,
+    watchSources: false,
+    snapshotReadOnly: true,
+  });
+  server = serve({ fetch: app.fetch, hostname: "127.0.0.1", port: 0 });
+  await new Promise((done, fail) => {
+    if (server.listening) done();
+    else {
+      server.once("listening", done);
+      server.once("error", fail);
+    }
+  });
+  const origin = `http://127.0.0.1:${server.address().port}`;
+  report.url = `${origin}/setup-project`;
+  browser = await chromium.launch({ headless: true });
+  page = await browser.newPage({ viewport: { width: 1440, height: 1000 } });
+  const errors = [];
+  page.on("pageerror", (error) => errors.push(error.message));
+  await page.goto(`${origin}/setup-project?token=${token}`, { waitUntil: "domcontentloaded" });
+  const select = page.getByRole("combobox", { name: "Perfil de autonomia" });
+  await expect(select).toHaveValue("balanced");
+  for (const preset of ["essential", "persistent", "balanced"]) {
+    await select.selectOption(preset);
+    if (preset === "essential")
+      await expect(
+        page.getByText("Nunca usa Astra automaticamente.", { exact: false }),
+      ).toBeVisible();
+    if (preset === "persistent")
+      await expect(
+        page.getByRole("status").filter({ hasText: "Sem limite de tentativas" }),
+      ).toBeVisible();
+    const saved = page.waitForResponse(
+      (response) =>
+        response.url().endsWith("/api/v2/project-settings") &&
+        response.request().method() === "PUT",
+    );
+    await page.getByRole("button", { name: "Salvar configurações" }).click();
+    const response = await saved;
+    assert.equal(response.status(), 200, await response.text());
+    const raw = await readFile(join(fixture, ".agents/config/project.yaml"), "utf8");
+    assert(raw.includes(`preset: ${preset}`));
+    const api = await fetch(`${origin}/api/v2/project-settings`, {
+      headers: { "x-zaip-session": token },
+    });
+    assert.equal(api.status, 200);
+    const data = await api.json();
+    assert.equal(data.autonomy.preset, preset);
+    await page.reload({ waitUntil: "domcontentloaded" });
+    await expect(select).toHaveValue(preset);
+    report.checks.push({ preset, api_status: 200, yaml_persisted: true, reload_confirmed: true });
+  }
+  await select.scrollIntoViewIfNeeded();
+  const runtimeSelect = page.getByLabel("Runtime", { exact: true });
+  const executionToggle = page.getByRole("checkbox", {
+    name: "Incluir configuração de execução",
+    exact: true,
+  });
+  if (!(await executionToggle.isChecked()))
+    await page.getByText("Incluir configuração de execução", { exact: true }).click();
+  await expect(executionToggle).toBeChecked();
+  if (await runtimeSelect.count()) {
+    await runtimeSelect.selectOption("managed");
+    const saved = page.waitForResponse(
+      (r) => r.url().endsWith("/api/v2/project-settings") && r.request().method() === "PUT",
+    );
+    await page.getByRole("button", { name: "Salvar configurações" }).click();
+    assert.equal((await saved).status(), 200);
+    const raw = await readFile(join(fixture, ".agents/config/project.yaml"), "utf8");
+    assert(raw.includes("runtime: managed"));
+    await page.reload({ waitUntil: "domcontentloaded" });
+    await expect(runtimeSelect).toHaveValue("managed");
+    report.checks.push({ scenario: "managed-runtime-yaml-reload", passed: true });
+  } else throw new Error("Runtime selector must be available for managed-mode proof");
+  await page.screenshot({ path: join(evidenceRoot, "autonomy-settings.png"), fullPage: true });
+  await page.setViewportSize({ width: 390, height: 844 });
+  await expect(page.locator(".project-settings-footer")).toHaveCSS("position", "static");
+  const disclosure = select.locator("xpath=../..").locator("p").last();
+  await disclosure.scrollIntoViewIfNeeded();
+  assert.equal(
+    await disclosure.evaluate((element) => {
+      const box = element.getBoundingClientRect();
+      return element.contains(
+        document.elementFromPoint(box.left + box.width / 2, box.top + box.height / 2),
+      );
+    }),
+    true,
+    "Mobile policy disclosure must not be covered by the save footer",
+  );
+  report.checks.push({ scenario: "mobile-disclosure-not-obscured", passed: true });
+  await select.scrollIntoViewIfNeeded();
+  await page.screenshot({
+    path: join(evidenceRoot, "autonomy-settings-mobile.png"),
+    fullPage: true,
+  });
+  await select.locator("xpath=../..").scrollIntoViewIfNeeded();
+  await select
+    .locator("xpath=../..")
+    .screenshot({ path: join(evidenceRoot, "autonomy-settings-mobile-detail.png") });
+  assert.deepEqual(errors, []);
+  report.screenshot_sha256 = createHash("sha256")
+    .update(await readFile(join(evidenceRoot, "autonomy-settings.png")))
+    .digest("hex");
+  report.passed = true;
+} catch (error) {
+  report.error = error.stack ?? String(error);
+  if (page)
+    report.failure_dom = await page
+      .locator("body")
+      .innerText()
+      .catch(() => "unavailable");
+  process.exitCode = 1;
+} finally {
+  await browser?.close();
+  if (server) {
+    server.closeAllConnections();
+    await new Promise((done) => server.close(done));
+  }
+  filesystem?.close();
+  report.finished_at = new Date().toISOString();
+  await writeFile(join(evidenceRoot, "report.json"), `${JSON.stringify(report, null, 2)}\n`);
+  await rm(fixture, { recursive: true, force: true });
+  console.log(JSON.stringify(report));
+}

package/templates/.agents/dashboard/scripts/verify-observability.mjs

@@ -0,0 +1,254 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname, join, resolve } from "node:path";
+import { promisify } from "node:util";
+import { createObservabilityFixture } from "../tests/observability-fixture.mjs";
+
+const repository = resolve(import.meta.dirname, "../../..");
+const runtimeRoot = join(repository, ".agents/dashboard/packages/local-runtime");
+const runtimeRequire = createRequire(join(runtimeRoot, "package.json"));
+const { createDashboardApp, rebuildSqliteReadModel, SqliteReadModelFileSystem } =
+  runtimeRequire("./dist/server.cjs");
+const { serve } = runtimeRequire("@hono/node-server");
+const { chromium } = runtimeRequire("@playwright/test");
+const exec = promisify(execFile);
+const testRoot = join(repository, ".local/sqlite/tests");
+await mkdir(testRoot, { recursive: true });
+const fixture = await mkdtemp(join(testRoot, "observability-"));
+const evidenceFlag = process.argv.indexOf("--evidence");
+const evidenceRoot =
+  evidenceFlag < 0 ? join(fixture, "evidence") : resolve(process.argv[evidenceFlag + 1]);
+await mkdir(evidenceRoot, { recursive: true });
+const report = {
+  synthetic: true,
+  platform: process.platform,
+  node_version: process.version,
+  candidate_version: JSON.parse(await readFile(join(repository, "package.json"), "utf8")).version,
+  started_at: new Date().toISOString(),
+  cli: [],
+  api: [],
+  dom: [],
+  passed: false,
+};
+const token = "synthetic-observability-local-only";
+let filesystem, server, browser, page;
+async function cli(args) {
+  const result = await exec(
+    process.execPath,
+    [join(repository, "packages/cli/dist/index.js"), ...args, "--workspace", fixture, "--json"],
+    {
+      cwd: fixture,
+      windowsHide: true,
+      timeout: 60_000,
+      maxBuffer: 4 * 1024 * 1024,
+      env: { ...process.env, CODEX_HOME: join(fixture, ".codex-home"), ZAIP_WORKSPACE: fixture },
+    },
+  );
+  return JSON.parse(result.stdout);
+}
+try {
+  const cases = await createObservabilityFixture(fixture);
+  for (const item of cases) {
+    const response = await cli(["task", "show", item.task]);
+    assert.equal(response.task.id, item.task);
+    assert.equal(response.task.status, item.status);
+    report.cli.push(response);
+  }
+  report.manifest = await cli(["manifest", "rebuild", "--confirm-full-scan"]);
+  assert.deepEqual(Object.keys(report.manifest.snapshot.periods.daily), ["2025-12-31"]);
+  assert.equal(report.manifest.snapshot.usage.total_tokens.known_sum, 15);
+  assert.equal(report.manifest.snapshot.usage.total_tokens.unknown, 1);
+  const manifest = JSON.parse(
+    await readFile(join(fixture, ".agents/records/lifecycle/entity-snapshot.json"), "utf8"),
+  );
+  for (const item of cases)
+    assert.equal(manifest.entities[`task:${item.task}`].status, item.status);
+  report.sqlite = await rebuildSqliteReadModel(fixture, { forceCanonical: true });
+  filesystem = new SqliteReadModelFileSystem(fixture);
+  const app = createDashboardApp(
+    fixture,
+    token,
+    join(repository, ".agents/dashboard/apps/frontend/dist"),
+    {
+      filesystem,
+      watchSources: false,
+      snapshotReadOnly: true,
+    },
+  );
+  server = serve({ fetch: app.fetch, hostname: "127.0.0.1", port: 0 });
+  await new Promise((resolveReady, reject) => {
+    if (server.listening) resolveReady();
+    else {
+      server.once("listening", resolveReady);
+      server.once("error", reject);
+    }
+  });
+  const origin = `http://127.0.0.1:${server.address().port}`;
+  report.url = origin;
+  async function api(route) {
+    const response = await fetch(`${origin}${route}`, {
+      headers: { "x-zaip-session": token },
+      signal: AbortSignal.timeout(20_000),
+    });
+    const body = await response.text();
+    assert.equal(response.status, 200, `${route}: ${body}`);
+    return JSON.parse(body);
+  }
+  for (const item of cases) {
+    const detail = await api(`/api/v2/tasks/${item.task}`);
+    const trace = await api(`/api/v2/tasks/${item.task}/trace`);
+    assert.equal(detail.task.id, item.task);
+    assert.equal(detail.task.status, item.status);
+    assert.equal(trace.task_id, item.task);
+    assert.equal(trace.change_id, item.change);
+    assert.equal(trace.task_progress, item.status === "completed" ? 100 : 0);
+    assert.equal(trace.usage.total_tokens.value, item.tokens);
+    assert.equal(trace.usage.total_tokens.unknown_runs, item.tokens === null ? 1 : 0);
+    assert.equal(trace.usage.cost.value, item.status === "failed" ? null : 0);
+    assert.equal(trace.usage.cost.unknown_runs, item.status === "blocked" ? 0 : 1);
+    if (item.status === "completed") assert.equal(trace.usage.cost.coverage_ratio, 2 / 3);
+    assert(trace.documents.some((document) => document.content.includes(item.run)));
+    if (item.status === "completed") {
+      const documents = trace.documents.map((document) => document.content).join("\n");
+      assert(documents.includes(`${item.run}-PRIOR`), "Retry predecessor omitted from trace");
+      assert(documents.includes(`${item.run}-FINALIZER`), "Finalizer child omitted from trace");
+      assert(documents.includes("retry_of_run_id"), "Retry relationship omitted from trace");
+      report.retry_finalizer = {
+        task: item.task,
+        predecessor: `${item.run}-PRIOR`,
+        finalizer: `${item.run}-FINALIZER`,
+        attempt: detail.task.attempt_count,
+      };
+      assert.equal(detail.task.attempt_count, 2);
+    }
+    const canonical = await filesystem.readText(`.agents/records/tasks/2026/01/${item.task}.md`);
+    assert(canonical.includes(item.task));
+    report.api.push({ detail, trace });
+  }
+  report.cost_filters = [];
+  for (const currency of ["BRL", "USD"]) {
+    const costs = await api(
+      `/api/v2/cost-monitor?scope=summary&currency=${currency}&from=2025-12-31&to=2025-12-31`,
+    );
+    assert.equal(costs.overview.run_count, 5, "Unknown Run disappeared from financial coverage");
+    assert.equal(costs.overview.total_tokens, 15);
+    assert.equal(costs.usage.rework.tokens.total, 15, "Observed rework was classified as new work");
+    assert.equal(costs.usage.new_work.tokens.total, 0);
+    const nextDay = await api(
+      `/api/v2/cost-monitor?scope=summary&currency=${currency}&from=2026-01-01&to=2026-01-01`,
+    );
+    assert.equal(nextDay.overview.run_count, 0, "UTC day leaked into Sao Paulo period");
+    report.cost_filters.push({ currency, costs, nextDay });
+  }
+  browser = await chromium.launch({ headless: true, timeout: 30_000 });
+  report.browser_version = browser.version();
+  page = await browser.newPage({ viewport: { width: 1440, height: 1000 } });
+  page.setDefaultTimeout(20_000);
+  report.browser_responses = [];
+  page.on("response", async (response) => {
+    if (response.url().includes("/api/v2/")) {
+      report.browser_responses.push({
+        url: response.url(),
+        status: response.status(),
+        body: await response.text().catch(() => ""),
+      });
+    }
+  });
+  await page.goto(`${origin}/?token=${token}`, { waitUntil: "domcontentloaded", timeout: 30_000 });
+  await page
+    .getByRole("navigation", { name: "Áreas do dashboard" })
+    .getByRole("button", { name: /Rastreabilidade/ })
+    .click();
+  const costCard = page
+    .locator("article")
+    .filter({ has: page.getByText("Custo Estimado", { exact: true }) })
+    .first();
+  assert(
+    (await costCard.innerText()).includes("Indisponível"),
+    "Partial known-zero costs were presented as an exact total",
+  );
+  // Task pagination spans lifecycle stages; explicitly load remaining stages
+  // through the real scrolling interaction before searching literal IDs.
+  const searchBox = page.getByRole("combobox", { name: "Buscar task por nome ou ID" });
+  await searchBox.click();
+  for (let attempt = 0; attempt < 12; attempt += 1) {
+    if ((await page.getByRole("option").count()) === cases.length) break;
+    await page.getByRole("listbox", { name: "Buscar task por nome ou ID" }).evaluate((element) => {
+      element.scrollTop = element.scrollHeight;
+      element.dispatchEvent(new Event("scroll", { bubbles: true }));
+    });
+    await page.waitForFunction(() => !document.body.innerText.includes("Carregando mais tasks"));
+  }
+  for (const item of cases) {
+    const search = page.getByRole("combobox", { name: "Buscar task por nome ou ID" });
+    await search.fill(item.task);
+    const traceResponse = page.waitForResponse(
+      (response) =>
+        response.url().endsWith(`/tasks/${item.task}/trace`) && response.status() === 200,
+    );
+    await page.locator(`[id="traceability-task-option-${item.task}"]`).click();
+    await traceResponse;
+    await page.getByText(item.task, { exact: true }).first().waitFor({ state: "visible" });
+    const text = await page.locator("body").innerText();
+    assert(text.includes(item.task), `UI omitted literal ID ${item.task}`);
+    if (item.status === "completed")
+      assert.match(text, /PROGRESSO\s+100%/, "Hydration replaced canonical completed progress");
+    report.dom.push({ task: item.task, text });
+    if (item.status === "completed") {
+      await page.locator('button[data-stage="execution"]').click();
+      for (const suffix of ["PRIOR", "FINALIZER"]) {
+        const literal = `${item.run}-${suffix}`;
+        await page.locator(".trace-stage-documents button").filter({ hasText: literal }).click();
+        const document = page.locator(".trace-document");
+        await document.waitFor({ state: "visible" });
+        const content = await document.locator("pre").innerText();
+        assert(content.includes(literal));
+        assert(
+          content.includes(
+            suffix === "FINALIZER" ? '"run_purpose":"finalization"' : '"status":"failed"',
+          ),
+        );
+        report.dom.push({ run: literal, text: content });
+        await document.getByRole("button").click();
+      }
+      await page
+        .getByRole("button", { name: "Fechar detalhes da etapa", exact: true })
+        .last()
+        .click();
+    }
+  }
+  await page.screenshot({ path: join(evidenceRoot, "traceability.png"), fullPage: true });
+  report.captured_at = new Date().toISOString();
+  report.passed = true;
+} catch (error) {
+  report.error = error.stack ?? String(error);
+  if (page) {
+    report.failure_dom = await page
+      .locator("body")
+      .innerText()
+      .catch(() => "DOM unavailable");
+    await page
+      .screenshot({ path: join(evidenceRoot, "failure.png"), fullPage: true })
+      .catch(() => {});
+  }
+  process.exitCode = 1;
+} finally {
+  await browser?.close();
+  if (server) {
+    server.closeAllConnections();
+    await new Promise((done) => server.close(done));
+  }
+  filesystem?.close();
+  report.finished_at = new Date().toISOString();
+  await writeFile(join(evidenceRoot, "observability.json"), `${JSON.stringify(report, null, 2)}\n`);
+  console.log(
+    JSON.stringify({ passed: report.passed, evidence: evidenceRoot, error: report.error }),
+  );
+  // Only this invocation's mkdtemp fixture is removed. Explicit evidence survives.
+  if (evidenceFlag >= 0) {
+    assert.equal(dirname(fixture), testRoot);
+    await rm(fixture, { recursive: true, force: true });
+  }
+}

package/templates/.agents/dashboard/scripts/verify-project-setup.mjs

@@ -0,0 +1,64 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { stripVTControlCharacters } from "node:util";
+
+// Dashboard verification is workspace tooling, not frontend source. Keep the
+// repository root explicit now that this script lives beside dashboard scripts.
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
+const mode = process.argv[2];
+if (!["test", "integration", "check"].includes(mode))
+  throw new Error("Expected test|integration|check");
+
+function execute(args, timeout = 180_000) {
+  const result = spawnSync(process.execPath, args, {
+    cwd: root,
+    encoding: "utf8",
+    windowsHide: true,
+    timeout,
+    maxBuffer: 8_000_000,
+  });
+  const output = stripVTControlCharacters((result.stdout ?? "") + "\n" + (result.stderr ?? ""));
+  if (result.status !== 0) {
+    process.stderr.write(output);
+    throw new Error("Project setup validation failed: " + (result.error?.message ?? result.status));
+  }
+  return output;
+}
+
+if (!existsSync(resolve(root, "node_modules/vitest/vitest.mjs"))) {
+  if (spawnSync("git", ["symbolic-ref", "-q", "HEAD"], { cwd: root }).status !== 1)
+    throw new Error("Prepare dependencies in the Task checkout first");
+  const pnpm = resolve(dirname(process.execPath), "node_modules/corepack/dist/pnpm.js");
+  execute([pnpm, "install", "--offline", "--frozen-lockfile", "--ignore-scripts"], 300_000);
+}
+
+if (mode === "check") {
+  for (const project of [
+    ".agents/dashboard/apps/frontend/tsconfig.json",
+    ".agents/design/apps/catalog/tsconfig.json",
+  ]) {
+    execute(["node_modules/typescript/bin/tsc", "--noEmit", "--project", project]);
+  }
+  console.log(JSON.stringify({ kind: "project_setup_typecheck", passed: true, mode }));
+} else {
+  const prefix = ".agents/dashboard/apps/frontend/src/";
+  const files =
+    mode === "test"
+      ? ["project-installation-status.test.ts", "project-settings.test.ts"]
+      : ["ProjectSettingsPage.dom.test.ts"];
+  const output = execute([
+    "node_modules/vitest/vitest.mjs",
+    "run",
+    ...files.map((file) => prefix + file),
+    "--maxWorkers=1",
+  ]);
+  const tests = output
+    .split("\n")
+    .find((line) => /^\s*Tests\s/.test(line))
+    ?.trim();
+  if (!tests || !/\b[1-9]\d* passed\b/.test(tests))
+    throw new Error("No project setup tests executed");
+  console.log(JSON.stringify({ kind: "project_setup_" + mode, passed: true, mode, tests, output }));
+}

package/templates/.agents/dashboard/tests/e2e/lease-global-setup.ts

@@ -0,0 +1,37 @@
+import type { FullConfig } from "@playwright/test";
+
+/** The suite owns one runtime across browser pages, including failed-test restarts. */
+export default async function holdSuiteLease(config: FullConfig) {
+  const baseURL = config.projects[0]?.use.baseURL;
+  if (!baseURL) throw new Error("Dashboard E2E requires its explicit server URL");
+  const url = new URL("/api/v2/browser-lease", baseURL);
+  url.searchParams.set("token", "e2e-token");
+  const controller = new AbortController();
+  const response = await fetch(url, { signal: controller.signal });
+  if (!response.ok || !response.body) {
+    controller.abort();
+    throw new Error(`Dashboard suite lease rejected: ${response.status}`);
+  }
+  const reader = response.body.getReader();
+  const first = await reader.read();
+  if (first.done || !new TextDecoder().decode(first.value).includes("lease")) {
+    controller.abort();
+    throw new Error("Dashboard suite did not acquire its real SSE lease");
+  }
+  let failure: unknown;
+  const drain = (async () => {
+    try {
+      while (!(await reader.read()).done) {
+        /* Keep the real lease stream consumed. */
+      }
+      if (!controller.signal.aborted) failure = new Error("Dashboard suite lease ended early");
+    } catch (error) {
+      if (!controller.signal.aborted) failure = error;
+    }
+  })();
+  return async () => {
+    controller.abort();
+    await drain;
+    if (failure) throw failure;
+  };
+}

package/templates/.agents/dashboard/tests/e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaip-ai/dashboard-e2e",
-  "version": "2.6.0",
+  "version": "3.1.0",
   "private": true,
   "type": "module",
   "scripts": {