@zaip-ai/cli 6.3.0 → 7.5.0

package/templates/.agents/dashboard/packages/local-runtime/src/active-codex-telemetry.test.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -18,6 +19,56 @@ afterEach(async () => {
 });
 
 describe("active Codex telemetry capture", () => {
+  it("retains preserved secondary sources read-only and exposes invalid proof without suppressing primary capture", async () => {
+    const primary = await runtimeFixture(`import {writeFileSync} from 'node:fs';
+      writeFileSync('capture-target.json','captured');
+      process.stdout.write(JSON.stringify({telemetry:{mode:'recent_exact_session',complete:true,captured:[{captured:true}]}}));`);
+    const secondary = await runtimeFixture("");
+    const receiptPath = join(primary, "preservation-receipt.json");
+    const receipt = JSON.stringify({
+      kind: "zaip-preserved-worktree-v1",
+      state: "preserved-not-attached",
+      root: primary,
+      worktree: secondary,
+      sha: "a".repeat(40),
+    });
+    const hash = (text: string) => createHash("sha256").update(text).digest("hex");
+    const markerDirectory = join(primary, ".agents/private/state/worktree-preservation/v1");
+    await mkdir(markerDirectory, { recursive: true });
+    await writeFile(receiptPath, receipt);
+    await writeFile(
+      join(markerDirectory, `${hash(secondary)}.json`),
+      JSON.stringify({
+        kind: "zaip-retained-worktree-capture-v1",
+        root: primary,
+        worktree: secondary,
+        sha: "a".repeat(40),
+        receipt: receiptPath,
+        receipt_sha256: hash(receipt),
+      }),
+    );
+    // Even an invalid marker for the primary cannot suppress its authorized capture.
+    await writeFile(join(markerDirectory, `${hash(primary)}.json`), "{}");
+    vi.spyOn(sources, "dashboardCanonicalSourceRoots").mockResolvedValue([primary, secondary]);
+    expect(await captureRepositoryActiveCodexTelemetry(primary)).toMatchObject({
+      captured_runs: 1,
+      capture_coverage: "retained_sources_excluded",
+      retained_worktrees: [{ workspace: secondary, state: "retained" }],
+    });
+    await expect(stat(join(secondary, "capture-target.json"))).rejects.toMatchObject({
+      code: "ENOENT",
+    });
+    expect(await readFile(join(primary, "capture-target.json"), "utf8")).toBe("captured");
+    await writeFile(receiptPath, "{}");
+    expect(await captureRepositoryActiveCodexTelemetry(primary)).toMatchObject({
+      captured_runs: 1,
+      retained_worktrees: [{ workspace: secondary, state: "invalid" }],
+    });
+    await expect(stat(join(secondary, "capture-target.json"))).rejects.toMatchObject({
+      code: "ENOENT",
+    });
+    expect(sources.dashboardCanonicalSourceRoots).toHaveBeenLastCalledWith(primary);
+  });
   it("bounds one automatic pass and rejects a partial receipt without progress", async () => {
     const root = await runtimeFixture("");
     const execute = vi.fn(async (_file: string, _args: string[], _options: unknown) => ({

package/templates/.agents/dashboard/packages/local-runtime/src/active-codex-telemetry.ts

@@ -2,6 +2,7 @@ import { execFile } from "node:child_process";
 import { resolve } from "node:path";
 import { promisify } from "node:util";
 import { WorkspaceFileSystem } from "@zaip-ai/core";
+import { type RetainedCapture, retainedWorktreeCapture } from "./retained-worktree-capture.js";
 import { lifecycleManifestState } from "./server-lifecycle-diagnostics.js";
 import { dashboardCanonicalSourceRoots } from "./sqlite-read-model-source-fingerprint.js";
 
@@ -21,6 +22,8 @@ export type ActiveCodexTelemetryCapture = {
   captured_runs: number;
   catch_up_complete?: boolean;
   pending_runs?: number;
+  retained_worktrees?: RetainedCapture[];
+  capture_coverage?: "all_sources" | "retained_sources_excluded";
   /** The active CLI reports whether a Run changed, not its segment cardinality. */
   captured_segments: number | null;
   manifest_state: "initialized" | "missing" | "invalid";
@@ -131,17 +134,28 @@ export async function captureRepositoryActiveCodexTelemetry(
   runtimeRoot = workspaceRoot,
 ): Promise<ActiveCodexTelemetryCapture> {
   const roots = await dashboardCanonicalSourceRoots(workspaceRoot);
+  const retained: RetainedCapture[] = [];
   // Registered checkouts contribute records, not executable runtime versions.
   // One current CLI serves every target; --workspace pins its storage and
   // exact source correlation even when the cwd belongs to another checkout.
+  const eligible: string[] = [];
+  for (const root of roots) {
+    const retention = await retainedWorktreeCapture(workspaceRoot, root);
+    if (retention) retained.push(retention);
+    else eligible.push(root);
+  }
   const results = await Promise.all(
-    roots.map((root) => captureActiveCodexTelemetry(root, runtimeRoot)),
+    eligible.map((root) => captureActiveCodexTelemetry(root, runtimeRoot)),
   );
   const primary = results[0];
   if (primary === undefined) throw new Error("No dashboard workspace was discovered");
   const capturedRuns = results.reduce((count, result) => count + result.captured_runs, 0);
   return {
     captured_runs: capturedRuns,
+    retained_worktrees: retained,
+    capture_coverage: retained.length ? "retained_sources_excluded" : "all_sources",
+    // Completeness applies only to eligible writers. Retained sources are
+    // explicitly excluded, not reported as captured and not an endless backlog.
     catch_up_complete: results.every((result) => result.catch_up_complete !== false),
     pending_runs: results.reduce((count, result) => count + (result.pending_runs ?? 0), 0),
     captured_segments: capturedRuns === 0 ? 0 : null,

package/templates/.agents/dashboard/packages/local-runtime/src/dashboard-diagnostics.test.ts

@@ -15,7 +15,7 @@ async function fixture(script: string) {
   return root;
 }
 async function logs(root: string) {
-  const directory = join(root, ".local/dashboard-logs");
+  const directory = join(root, ".local/temp/dashboard-logs");
   return (
     await Promise.all(
       (await readdir(directory)).map((name) => readFile(join(directory, name), "utf8")),

package/templates/.agents/dashboard/packages/local-runtime/src/project-settings.ts

@@ -19,6 +19,7 @@ import {
   summarizeProjectInstallation,
   summarizeProjectStatus,
 } from "./project-installation-summary.js";
+import { architectureLabels, componentLabels } from "./project-stack-labels.js";
 
 export {
   PROJECT_INSTALLATION_AREA_REQUIREMENTS,
@@ -338,8 +339,8 @@ async function executableComponent(
     : "1.16.1";
   const local =
     command === "git"
-      ? ".local/git/cmd/git.exe"
-      : `.local/terraform/v${safeTerraformVersion}-${process.platform}-${process.arch}/${
+      ? ".agents/private/state/git/cmd/git.exe"
+      : `.agents/private/state/terraform/v${safeTerraformVersion}-${process.platform}-${process.arch}/${
           process.platform === "win32" ? "terraform.exe" : "terraform"
         }`;
   const localPath = join(filesystem.root, local);
@@ -484,44 +485,6 @@ export async function persistProjectSettings(
   return candidate;
 }
 
-const componentLabels: Record<string, string> = {
-  primary_language: "Linguagem principal",
-  backend_runtime: "Runtime backend",
-  backend_api: "Framework backend / API",
-  query_builder: "Query builder",
-  database: "Banco de dados",
-  auth_storage: "Autenticação e Storage",
-  cache_messaging: "Cache e mensageria",
-  async_queue: "Filas e processamento assíncrono",
-  backend_infrastructure: "Infraestrutura backend",
-  backend_hosting: "Hospedagem do backend",
-  web_framework: "Framework do Web App",
-  web_language: "Linguagem do Web App",
-  web_build: "Build do Web App",
-  frontend_hosting: "Hospedagem do frontend",
-  site_framework: "Framework do site",
-  site_language: "Linguagem do site",
-  site_islands: "Componentes interativos",
-  site_build: "Build do site",
-  site_hosting: "Hospedagem do site",
-  prometheus: "Coleta de métricas",
-  grafana: "Dashboards",
-  uptime_kuma: "Monitoramento de disponibilidade",
-  cadvisor: "Métricas de containers",
-  node_exporter: "Métricas de host",
-  redis_exporter: "Métricas do Redis",
-  k6: "Teste de carga",
-  autocannon: "Teste HTTP de carga",
-};
-
-const architectureLabels: Record<string, string> = {
-  backend_data_and_managed_services: "Dados e serviços gerenciados",
-  backend_api_and_business_rules: "APIs e regras de negócio",
-  backend_async_processing: "Filas e processamento assíncrono",
-  backend_infrastructure: "Infraestrutura backend",
-  backend_hosting: "Hospedagem do backend",
-};
-
 export function renderSoftwareArchitecture(config: ProjectConfig): string {
   const autonomy = resolveAutonomy(config.autonomy);
   const overrides = recordValue(config.stack.overrides);

package/templates/.agents/dashboard/packages/local-runtime/src/project-stack-labels.ts

@@ -0,0 +1,40 @@
+/** Labels shared by the canonical architecture projection. */
+export const componentLabels: Record<string, string> = {
+  primary_language: "Linguagem principal",
+  backend_runtime: "Runtime backend",
+  backend_api: "Framework backend / API",
+  query_builder: "Query builder",
+  database: "Banco de dados",
+  auth_storage: "Autenticação e Storage",
+  backend_secrets: "Gestão de credenciais",
+  cache_messaging: "Cache e mensageria",
+  async_queue: "Filas e processamento assíncrono",
+  backend_infrastructure: "Infraestrutura backend",
+  backend_hosting: "Hospedagem do backend",
+  web_framework: "Framework do Web App",
+  web_language: "Linguagem do Web App",
+  web_build: "Build do Web App",
+  frontend_hosting: "Hospedagem do frontend",
+  site_framework: "Framework do site",
+  site_language: "Linguagem do site",
+  site_islands: "Componentes interativos",
+  site_build: "Build do site",
+  site_hosting: "Hospedagem do site",
+  prometheus: "Coleta de métricas",
+  grafana: "Dashboards",
+  uptime_kuma: "Monitoramento de disponibilidade",
+  cadvisor: "Métricas de containers",
+  node_exporter: "Métricas de host",
+  redis_exporter: "Métricas do Redis",
+  k6: "Teste de carga",
+  autocannon: "Teste HTTP de carga",
+};
+
+export const architectureLabels: Record<string, string> = {
+  backend_secrets: "Gestão de credenciais do backend",
+  backend_data_and_managed_services: "Dados e serviços gerenciados",
+  backend_api_and_business_rules: "APIs e regras de negócio",
+  backend_async_processing: "Filas e processamento assíncrono",
+  backend_infrastructure: "Infraestrutura backend",
+  backend_hosting: "Hospedagem do backend",
+};

package/templates/.agents/dashboard/packages/local-runtime/src/retained-worktree-capture.ts

@@ -0,0 +1,81 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { resolve } from "node:path";
+import { resolveHistoricalAbsolutePath } from "@zaip-ai/core";
+
+const hash = (bytes: Buffer | string) => createHash("sha256").update(bytes).digest("hex");
+export type RetainedCapture = { workspace: string; state: "retained" | "invalid"; reason: string };
+
+async function boundedFile(path: string, max: number): Promise<Buffer> {
+  const before = await lstat(path, { bigint: true });
+  if (
+    !before.isFile() ||
+    before.isSymbolicLink() ||
+    before.nlink !== 1n ||
+    before.size > BigInt(max) ||
+    resolve(await realpath(path)) !== resolve(path)
+  )
+    throw new Error("Invalid retained marker path");
+  const bytes = await readFile(path);
+  const after = await lstat(path, { bigint: true });
+  for (const key of ["ino", "size", "mtimeNs", "ctimeNs", "nlink"] as const)
+    if (before[key] !== after[key]) throw new Error("Retained marker changed");
+  return bytes;
+}
+
+/** A marker suspends automatic writes; canonical read sources remain unchanged. */
+export async function retainedWorktreeCapture(
+  primary: string,
+  workspace: string,
+): Promise<RetainedCapture | null> {
+  const root = resolve(primary),
+    target = resolve(workspace);
+  if (root === target) return null; // the active primary is never suppressed
+  const markerPath = resolve(
+    root,
+    ".agents/private/state/worktree-preservation/v1",
+    `${hash(target)}.json`,
+  );
+  let bytes: Buffer;
+  try {
+    bytes = await boundedFile(markerPath, 16384);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    return { workspace: target, state: "invalid", reason: "retention_marker_unreadable" };
+  }
+  try {
+    const marker = JSON.parse(bytes.toString("utf8"));
+    if (
+      marker.kind !== "zaip-retained-worktree-capture-v1" ||
+      marker.root !== root ||
+      marker.worktree !== target ||
+      !/^[a-f0-9]{40}$/.test(marker.sha) ||
+      typeof marker.receipt !== "string" ||
+      resolve(await realpath(target)) !== target
+    )
+      throw new Error("Marker identity differs");
+    const receiptBytes = await boundedFile(
+      await resolveHistoricalAbsolutePath(root, marker.receipt),
+      1024 * 1024,
+    );
+    if (hash(receiptBytes) !== marker.receipt_sha256) throw new Error("Receipt changed");
+    const receipt = JSON.parse(receiptBytes.toString("utf8"));
+    const identity =
+      receipt.kind === "zaip-preserved-worktree-v1"
+        ? receipt
+        : receipt.kind === "zaip-preserved-metadata-overlay-v1"
+          ? receipt.inventory
+          : null;
+    if (
+      !identity ||
+      receipt.state !== "preserved-not-attached" ||
+      identity.root !== root ||
+      identity.worktree !== target ||
+      identity.sha !== marker.sha
+    )
+      throw new Error("Receipt identity differs");
+    return { workspace: target, state: "retained", reason: "preserved_worktree_read_only" };
+  } catch {
+    return { workspace: target, state: "invalid", reason: "retention_proof_invalid" };
+  }
+}

package/templates/.agents/dashboard/packages/local-runtime/src/server-board.ts

@@ -58,6 +58,7 @@ export function boardPage(
   limit: number,
   manualOrder: readonly string[],
   filters: BoardFilters,
+  allStages = false,
 ) {
   const sourceByChange = new Map(
     projection.changes.map((change) => [change.id, change.source.type] as const),
@@ -101,7 +102,11 @@ export function boardPage(
       (item) =>
         (item.kind === "task"
           ? taskWorkStage(item.row)
-          : macroWorkStage(item.row, projection.tasks)) === stage,
+          : macroWorkStage(item.row, projection.tasks)) === stage ||
+        (allStages &&
+          (item.kind === "task"
+            ? taskWorkStage(item.row)
+            : macroWorkStage(item.row, projection.tasks)) !== null),
     )
     .toSorted((left, right) => {
       const order = new Map(manualOrder.map((id, index) => [id, index] as const));
@@ -116,7 +121,11 @@ export function boardPage(
     (item) =>
       (item.kind === "task"
         ? taskWorkStage(item.row)
-        : macroWorkStage(item.row, projection.tasks)) === stage,
+        : macroWorkStage(item.row, projection.tasks)) === stage ||
+      (allStages &&
+        (item.kind === "task"
+          ? taskWorkStage(item.row)
+          : macroWorkStage(item.row, projection.tasks)) !== null),
   );
   const stageItems =
     filters.kind === ""

package/templates/.agents/dashboard/packages/local-runtime/src/server-hono-security.test.ts

@@ -1,3 +1,7 @@
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { describe, expect, it } from "vitest";
 
@@ -15,3 +19,39 @@ describe("Dashboard HTTP query security", () => {
     expect(await response.json()).toEqual({ currency: "BRL" });
   });
 });
+
+describe("Static paths retain their middleware boundary", () => {
+  it("never serves protected bytes through encoded paths without authorization", async () => {
+    const root = await mkdtemp(join(tmpdir(), "zaip-hono-security-"));
+    try {
+      await mkdir(join(root, "private"));
+      await writeFile(join(root, "private", "proof.txt"), "synthetic-protected-content");
+      const app = new Hono();
+      app.use("/private/*", async (context, next) => {
+        if (context.req.header("authorization") !== "fixture-session")
+          return context.text("Unauthorized", 401);
+        return next();
+      });
+      app.use("/*", serveStatic({ root }));
+      const authorized = await app.request("http://localhost/private/proof.txt", {
+        headers: { authorization: "fixture-session" },
+      });
+      expect(authorized.status).toBe(200);
+      expect(await authorized.text()).toBe("synthetic-protected-content");
+      for (const path of [
+        "/private/proof.txt",
+        "/%70rivate/proof.txt",
+        "/%2570rivate/proof.txt",
+        "/%70rivate/proof.txt%",
+        "/private%2fproof.txt",
+        "/private%252fproof.txt",
+      ]) {
+        const response = await app.request(`http://localhost${path}`);
+        expect([400, 401, 404]).toContain(response.status);
+        expect(await response.text()).not.toContain("synthetic-protected-content");
+      }
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});

package/templates/.agents/dashboard/packages/local-runtime/src/server-operations-routes.ts

@@ -14,7 +14,6 @@ import {
   headOrJson,
   requireV2Layout,
   V2WorkspaceRequiredError,
-  WORK_PRIORITY_PATH,
 } from "./server-http-contracts.js";
 import {
   changeEntityPageRows,
@@ -27,11 +26,11 @@ import { projectionPeriodFilter } from "./server-period.js";
 import {
   buildCanonicalOperationsProjection,
   knownWorkIds,
-  normalizeWorkPriority,
   readWorkPriority,
 } from "./server-projections.js";
 import { buildFirstFoldQuickProjection } from "./server-read-projections.js";
 import type { DashboardRouteContext } from "./server-route-context.js";
+import { registerWorkPriorityRoute } from "./server-work-priority-route.js";
 import { SqliteReadModelFileSystem, sqliteViewMetadata } from "./sqlite-read-model.js";
 export function registerOperationsRoutes(app: Hono, dependencies: DashboardRouteContext) {
   const {
@@ -41,7 +40,6 @@ export function registerOperationsRoutes(app: Hono, dependencies: DashboardRoute
     readLayout,
     readSnapshot,
     readAggregate,
-    clearSnapshotCache,
   } = dependencies;
   app.on(["GET", "HEAD"], `${API_PREFIX}/operations`, async (context) => {
     try {
@@ -104,6 +102,37 @@ export function registerOperationsRoutes(app: Hono, dependencies: DashboardRoute
         const page = await readAggregate(`operations:board-page:${pageKey}`, async () =>
           boardPage(board.projection, stage, offset, limit, board.priority.item_ids, filters),
         );
+        if (filesystem instanceof SqliteReadModelFileSystem) {
+          const summary = await readAggregate(
+            `operations:board-financial:${JSON.stringify({ from, to, ...filters })}`,
+            async () => {
+              const selected = boardPage(
+                board.projection,
+                stage,
+                0,
+                Number.MAX_SAFE_INTEGER,
+                [],
+                filters,
+                true,
+              );
+              return filesystem.workFinancialSummary([
+                ...selected.tasks.map((row) => ({ kind: "task" as const, id: row.id })),
+                ...selected.specs.map((row) => ({ kind: "spec" as const, id: row.id })),
+                ...selected.prds.map((row) => ({ kind: "prd" as const, id: row.id })),
+              ]);
+            },
+          );
+          return headOrJson(
+            context,
+            {
+              ...page,
+              ...filesystem.financialSnapshotMetadata(),
+              financial_summary: { ...summary, from, to },
+            },
+            200,
+            true,
+          );
+        }
         return headOrJson(context, page, 200, true);
       }
       if (scope === "classification") {
@@ -345,17 +374,7 @@ export function registerOperationsRoutes(app: Hono, dependencies: DashboardRoute
     return headOrJson(context, payload, 200, true);
   });
   registerDailyReadModelRoute(app, filesystem, readAggregate, headOrJson);
-  app.put(`${API_PREFIX}/work-priority`, async (context) => {
-    const candidate = normalizeWorkPriority(await context.req.json());
-    // Priority is canonical queue configuration, never snapshot content.
-    // Keep every other settings mutation blocked in snapshot-serving mode.
-    await canonicalFilesystem.writeTextAtomic(
-      WORK_PRIORITY_PATH,
-      `${JSON.stringify(candidate, null, 2)}\n`,
-    );
-    clearSnapshotCache();
-    return context.json(candidate);
-  });
+  registerWorkPriorityRoute(app, dependencies);
   app.on(["GET", "HEAD"], `${API_PREFIX}/snapshot`, async (context) => {
     try {
       return headOrJson(context, await readSnapshot(context));

package/templates/.agents/dashboard/packages/local-runtime/src/server-project-settings-routes.test.ts

@@ -0,0 +1,83 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { parseProjectConfig, parseYaml, serializeYaml, WorkspaceFileSystem } from "@zaip-ai/core";
+import { Hono } from "hono";
+import { afterEach, expect, it, vi } from "vitest";
+import { readProjectSettings } from "./project-settings.js";
+import { registerProjectSettingsRoutes } from "./server-project-settings-routes.js";
+
+const workspaceRoot = resolve(import.meta.dirname, "../../../../..");
+const roots: string[] = [];
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
+});
+
+it("reads canonical settings and overview, persisting valid updates with one cache invalidation", async () => {
+  const root = await mkdtemp(join(tmpdir(), "zaip-project-settings-routes-"));
+  roots.push(root);
+  const filesystem = new WorkspaceFileSystem(root);
+  const configPath = join(root, ".agents/config/project.yaml");
+  const source = await readFile(join(workspaceRoot, ".agents/config/project.yaml"), "utf8");
+  const project = parseProjectConfig(parseYaml(source));
+  project.project.name = "Canonical route fixture";
+  await mkdir(join(root, ".agents/config/agents"), { recursive: true });
+  await writeFile(configPath, serializeYaml(project), "utf8");
+  await writeFile(
+    join(root, ".agents/config/agents/catalog.yaml"),
+    await readFile(join(workspaceRoot, ".agents/config/agents/catalog.yaml"), "utf8"),
+    "utf8",
+  );
+  await writeFile(
+    join(root, ".agents/config/framework.lock.yaml"),
+    "framework:\n  version: 0.0.123\n",
+  );
+  const invalidate = vi.fn();
+  const app = new Hono();
+  registerProjectSettingsRoutes(app, filesystem, invalidate);
+
+  const settings = await app.request("/api/v2/project-settings");
+  expect(settings.status).toBe(200);
+  await expect(settings.json()).resolves.toEqual(project);
+  const overview = await app.request("/api/v2/project-settings/overview");
+  expect(overview.status).toBe(200);
+  await expect(overview.json()).resolves.toMatchObject({ framework_version: "0.0.123" });
+  for (const path of ["/api/v2/project-settings", "/api/v2/project-settings/overview"]) {
+    const head = await app.request(path, { method: "HEAD" });
+    expect(head.status).toBe(200);
+    expect(await head.text()).toBe("");
+  }
+  expect(invalidate).not.toHaveBeenCalled();
+
+  const updatedProject = {
+    ...project,
+    project: { ...project.project, name: "Updated canonical route fixture" },
+  };
+  const updated = await app.request("/api/v2/project-settings", {
+    method: "PUT",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(updatedProject),
+  });
+  expect(updated.status, await updated.clone().text()).toBe(200);
+  await expect(updated.json()).resolves.toEqual(updatedProject);
+  await expect(readProjectSettings(filesystem)).resolves.toEqual(updatedProject);
+  expect(invalidate).toHaveBeenCalledTimes(1);
+
+  const persisted = await readFile(configPath, "utf8");
+  for (const body of [
+    "{invalid-json",
+    JSON.stringify({
+      ...updatedProject,
+      tracking: { ...updatedProject.tracking, currency: "real" },
+    }),
+  ]) {
+    const invalid = await app.request("/api/v2/project-settings", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body,
+    });
+    expect(invalid.status).toBe(400);
+    await expect(readFile(configPath, "utf8")).resolves.toBe(persisted);
+    expect(invalidate).toHaveBeenCalledTimes(1);
+  }
+});

package/templates/.agents/dashboard/packages/local-runtime/src/server-project-settings-routes.ts

@@ -0,0 +1,41 @@
+import type { WorkspaceFileSystem } from "@zaip-ai/core";
+import type { Hono } from "hono";
+import {
+  persistProjectSettings,
+  readProjectOverview,
+  readProjectSettings,
+} from "./project-settings.js";
+import { API_PREFIX, headOrJson } from "./server-http-contracts.js";
+
+export function registerProjectSettingsRoutes(
+  app: Hono,
+  canonicalFilesystem: WorkspaceFileSystem,
+  clearSnapshotCache: () => void,
+): void {
+  app.on(["GET", "HEAD"], `${API_PREFIX}/project-settings`, async (context) => {
+    try {
+      return headOrJson(context, await readProjectSettings(canonicalFilesystem));
+    } catch (error) {
+      return headOrJson(
+        context,
+        { error: error instanceof Error ? error.message : String(error) },
+        400,
+      );
+    }
+  });
+  app.on(["GET", "HEAD"], `${API_PREFIX}/project-settings/overview`, async (context) => {
+    return headOrJson(context, await readProjectOverview(canonicalFilesystem));
+  });
+  app.put(`${API_PREFIX}/project-settings`, async (context) => {
+    try {
+      const persisted = await persistProjectSettings(canonicalFilesystem, await context.req.json());
+      clearSnapshotCache();
+      return context.json(persisted);
+    } catch (error) {
+      return context.json(
+        { error: error instanceof Error ? error.message : "Project settings update failed" },
+        400,
+      );
+    }
+  });
+}

package/templates/.agents/dashboard/packages/local-runtime/src/server-projections.ts

@@ -10,6 +10,7 @@ import {
 import type { Context } from "hono";
 import { mergeManifestRuns } from "./manifest-runs.js";
 import { filterCompactCostRuns } from "./server-cost-run-search.js";
+import { normalizeRunRangeBoundary, runTimestampInRange } from "./server-run-range.js";
 import {
   configuredAgentNames,
   invocationSummariesForPeriod,
@@ -427,24 +428,7 @@ async function manifestRunRange(
   };
 }
 
-export function runTimestampInRange(timestamp: string, from: string, to: string): boolean {
-  const value = Date.parse(timestamp);
-  const start = Date.parse(normalizeRunRangeBoundary(from, "start"));
-  const end = Date.parse(normalizeRunRangeBoundary(to, "end"));
-  return (
-    Number.isFinite(value) &&
-    Number.isFinite(start) &&
-    Number.isFinite(end) &&
-    value >= start &&
-    value <= end
-  );
-}
-
-function normalizeRunRangeBoundary(value: string, boundary: "start" | "end"): string {
-  if (/^\d{4}-\d{2}-\d{2}$/.test(value))
-    return `${value}T${boundary === "start" ? "00:00:00.000" : "23:59:59.999"}Z`;
-  return value;
-}
-
 export { filterCostRunRows, pageCostRunRows } from "./server-cost-run-search.js";
 export { isUnfilteredCostRequest, readCurrentFxRate } from "./server-projection-loaders.js";
+
+export { runTimestampInRange } from "./server-run-range.js";

package/templates/.agents/dashboard/packages/local-runtime/src/server-reconciliation-diagnostics.test.ts

@@ -14,7 +14,7 @@ async function fixture() {
   return root;
 }
 async function events(root: string) {
-  const directory = join(root, ".local/dashboard-logs");
+  const directory = join(root, ".local/temp/dashboard-logs");
   const content = (
     await Promise.all(
       (await readdir(directory)).map((name) => readFile(join(directory, name), "utf8")),
@@ -108,7 +108,7 @@ describe("manual reconciliation observable boundaries", () => {
       projection_refresh_started: true,
       request_id: expect.any(String),
       job_id: expect.any(String),
-      log_directory: ".local/dashboard-logs",
+      log_directory: ".local/temp/dashboard-logs",
     });
     await vi.waitFor(() => expect(refresh).toHaveBeenCalledOnce());
     expect((await events(root)).map((item) => item.event)).toEqual(