@zaip-ai/cli 6.3.0 → 7.6.0

package/templates/.agents/dashboard/apps/frontend/e2e/release-delivery-fixture.mjs

@@ -0,0 +1,117 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { deliveryReceipt } from "./release-delivery-receipt.mjs";
+
+const when = "2026-01-01T02:30:00.000Z";
+
+export async function createDeliveryFixture(root, createObservabilityFixture) {
+  const cases = await createObservabilityFixture(root);
+  const task = cases.find((item) => item.status === "completed");
+  const actor = cases.find((item) => item.status === "blocked");
+  const executionId = "EXEC-2026-01-01-00-00-LAB-DELIVERY-A001";
+  const records = join(root, ".agents/records");
+  const taskPath = join(records, "tasks/2026/01", task.task + ".md");
+  const taskContent = await readFile(taskPath, "utf8");
+  const hash = "a".repeat(64);
+  const ref = { revision: 1, hash, execution_id: executionId };
+  await writeFile(
+    taskPath,
+    taskContent.replace(
+      /^---\r?\n/,
+      '---\ntarget_release: "7.6"\nplan_ref: ' + JSON.stringify(ref) + "\n",
+    ),
+  );
+  const executionPath = join(records, "executions/2026/01", executionId, "execution.md");
+  const decisions = join(records, "changes/2026/01", actor.change, "decisions");
+  const humanId = "DEC-HUMAN-2026-01-01-00-00-LAB-A001";
+  const receipt = await deliveryReceipt(root, task, actor, executionId, humanId);
+  async function put(path, fields) {
+    await mkdir(dirname(path), { recursive: true });
+    const markdown =
+      "---\n" +
+      Object.entries(fields)
+        .map(([key, value]) => key + ": " + JSON.stringify(value))
+        .join("\n") +
+      "\n---\n\n# Synthetic dashboard regression\n";
+    await writeFile(path, markdown);
+  }
+  function decision(id, origin, payload, confirmed = true) {
+    return put(join(decisions, id + ".md"), {
+      schema_version: 2,
+      id,
+      title: "Synthetic release attestation for local dashboard test",
+      scope_type: "change",
+      scope_id: actor.change,
+      origin,
+      category: "contract",
+      context: "Isolated test",
+      decision: JSON.stringify(payload),
+      reason: "Exercise the release projection",
+      alternatives: [],
+      consequences: ["Synthetic evidence"],
+      reversible: true,
+      rollback: "Discard fixture",
+      confidence: origin === "human" ? null : 1,
+      created_at: when,
+      confirmed_at: origin === "human" && confirmed ? when : null,
+    });
+  }
+  async function setExecution(status) {
+    await put(executionPath, {
+      schema_version: 2,
+      id: executionId,
+      revision: status === "completed" ? 2 : 1,
+      status,
+      status_reason: status === "blocked" ? "Synthetic open execution" : null,
+      policy: {
+        failure_policy: "stop_on_terminal_failure",
+        max_parallelism: 1,
+        max_operational_retries: 1,
+        max_repair_cycles_per_task: 0,
+        verification_mode: "scoped",
+      },
+      created_at: when,
+      updated_at: when,
+      started_at: when,
+      finished_at: status === "completed" ? when : null,
+      result: status === "completed" ? "Synthetic closure" : null,
+      kind: "delivery",
+      client_turn_id: "synthetic-turn",
+      origin: { type: "task", task_id: task.task },
+      plan_revision: 1,
+      plan_hash: hash,
+      dag: {
+        nodes: [{ task_id: task.task, change_id: task.change, depends_on: [] }],
+        topological_order: [task.task],
+      },
+    });
+  }
+  function authorize(target = task.task, confirmed = true) {
+    return decision(
+      humanId,
+      "human",
+      { ...receipt.authorization, target_task_id: target },
+      confirmed,
+    );
+  }
+  async function issue() {
+    await receipt.write();
+    await decision(receipt.issuanceId, "agent", receipt.issuance);
+  }
+  await setExecution("blocked");
+  await authorize();
+  return {
+    taskId: task.task,
+    otherTaskId: actor.task,
+    receiptPath:
+      ".agents/records/changes/2026/01/" +
+      actor.change +
+      "/decisions/" +
+      receipt.issuanceId +
+      ".md",
+    authorize,
+    issue,
+    setExecution,
+    writeReceipt: receipt.write,
+  };
+}

package/templates/.agents/dashboard/apps/frontend/e2e/release-delivery-lab.mjs

@@ -0,0 +1,246 @@
+// Run from the checkout root after building the dashboard and CLI.
+import assert from "node:assert/strict";
+import { execFileSync, spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { once } from "node:events";
+import { mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { chromium, expect } from "@playwright/test";
+import { createObservabilityFixture } from "../../../tests/observability-fixture.mjs";
+import { createDeliveryFixture } from "./release-delivery-fixture.mjs";
+
+const repository = await realpath(process.cwd());
+const temporary = await realpath(tmpdir());
+const workspace = await mkdtemp(join(temporary, "zaip-v76-dashboard-"));
+const token = randomBytes(24).toString("hex");
+const dashboard = join(repository, ".agents/dashboard");
+const runtime = join(dashboard, "packages/local-runtime");
+const env = {
+  ...process.env,
+  ZAIP_WORKSPACE: workspace,
+  ZAIP_SQLITE_DB_PATH: join(workspace, ".local/sqlite/dashboard.sqlite"),
+  ZAIP_UI_ROOT: resolve(process.env.ZAIP_LAB_UI_DIST || join(dashboard, "apps/frontend/dist")),
+  ZAIP_UI_TOKEN: token,
+  ZAIP_SERVER_PORT: "0",
+  ZAIP_DASHBOARD_WATCH_SOURCES: "0",
+};
+const output = process.env.ZAIP_LAB_EVIDENCE;
+const observations = [];
+let browser;
+
+function privateCommand(command, args) {
+  return execFileSync(command, args, {
+    cwd: workspace,
+    env,
+    encoding: "utf8",
+    windowsHide: true,
+    maxBuffer: 4 * 1024 * 1024,
+    timeout: 90000,
+  });
+}
+function rebuildManifest() {
+  const result = JSON.parse(
+    privateCommand(process.execPath, [
+      join(repository, "packages/cli/dist/index.js"),
+      "manifest",
+      "rebuild",
+      "--confirm-full-scan",
+      "--workspace",
+      workspace,
+      "--json",
+    ]),
+  );
+  assert.ok(result.indexed > 0 && result.indexed < 64, "unexpected fixture record count");
+}
+function refresh() {
+  rebuildManifest();
+  // Startup may serve its previous valid SQLite generation. Promote the new one through the shipped CLI.
+  privateCommand(process.execPath, [join(runtime, "scripts/rebuild-sqlite-read-model.mjs")]);
+}
+async function withPreview(inspect) {
+  const child = spawn(process.execPath, [join(runtime, "dist/server.cjs")], {
+    cwd: repository,
+    env,
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  const closed = once(child, "close");
+  const lease = new AbortController();
+  let leaseReader;
+  let logs = "";
+  for (const stream of [child.stdout, child.stderr])
+    stream.on("data", (chunk) => {
+      logs = (logs + chunk).slice(-16384);
+    });
+  try {
+    await expect
+      .poll(
+        () => {
+          if (child.exitCode !== null) throw Error("preview exited before readiness");
+          return logs.match(/http:\/\/127\.0\.0\.1:\d+\/api\/v2\/health/)?.[0];
+        },
+        { timeout: 45000 },
+      )
+      .toBeTruthy();
+    const origin = new URL(logs.match(/http:\/\/127\.0\.0\.1:\d+\/api\/v2\/health/)[0]).origin;
+    // The lab owns this preview until inspect completes. Acquire the standard
+    // launcher lease while Chromium opens a fresh context on this loopback port.
+    const deadline = setTimeout(() => lease.abort(), 10000);
+    try {
+      const response = await fetch(origin + "/api/v2/browser-lease?token=" + token, {
+        redirect: "error",
+        signal: lease.signal,
+      });
+      assert.equal(response.status, 200);
+      assert.match(response.headers.get("content-type") || "", /text\/event-stream/);
+      leaseReader = response.body.getReader();
+      const frame = await leaseReader.read();
+      assert.ok(!frame.done && frame.value.length > 0, "preview lease did not open");
+    } finally {
+      clearTimeout(deadline);
+    }
+    const readHealth = async () =>
+      (await fetch(origin + "/api/v2/health", { signal: AbortSignal.timeout(10000) })).json();
+    const started = Date.now();
+    const initial = await readHealth();
+    assert.equal(await realpath(initial.workspace), workspace);
+    let current = initial;
+    while (current.snapshot_state !== "current") {
+      assert.ok(!current.projection_refresh_failure, "preview snapshot refresh failed");
+      assert.ok(Date.now() - started < 30000, "preview snapshot did not become current");
+      await delay(100);
+      current = await readHealth();
+    }
+    console.log(
+      JSON.stringify({
+        pid: child.pid,
+        initial_snapshot: initial.snapshot_state,
+        final_snapshot: current.snapshot_state,
+        elapsed_ms: Date.now() - started,
+      }),
+    );
+
+    return await inspect(origin, child.pid);
+  } finally {
+    lease.abort();
+    leaseReader?.releaseLock();
+    if (child.exitCode === null && child.signalCode === null) child.kill();
+    await closed;
+  }
+}
+
+async function see(origin, pid, fixture, phase, published, closed) {
+  const context = await browser.newContext({
+    locale: "pt-BR",
+    viewport: { width: 1365, height: 900 },
+  });
+  try {
+    const page = await context.newPage();
+    page.setDefaultTimeout(30000);
+    const path = "/api/v2/tasks/" + fixture.taskId + "/trace";
+    const received = [];
+    page.on("response", async (response) => {
+      if (response.ok() && new URL(response.url()).pathname === path)
+        received.push(await response.json());
+    });
+    await page.route("**/*", (route) =>
+      new URL(route.request().url()).origin === origin ? route.continue() : route.abort(),
+    );
+    await page.goto(origin + "/?token=" + token, { waitUntil: "domcontentloaded" });
+    await page
+      .getByRole("navigation", { name: "Áreas do dashboard" })
+      .getByRole("button", { name: /Rastreabilidade/ })
+      .click();
+    const search = page.getByRole("combobox", { name: "Buscar task por nome ou ID" });
+    await search.click();
+    await search.fill(fixture.taskId);
+    await page
+      .locator('[role="option"][id="traceability-task-option-' + fixture.taskId + '"]')
+      .click();
+    await expect.poll(() => received.at(-1)?.task_id, { timeout: 30000 }).toBe(fixture.taskId);
+    const delivery = received.at(-1).release_delivery;
+    assert.ok(delivery, "release projection missing on the real trace endpoint");
+    assert.equal(delivery.publication, published ? "verified" : "unverified");
+    assert.equal(delivery.execution_status, closed ? "completed" : "blocked");
+    assert.equal(delivery.receipt_path, published ? fixture.receiptPath : null);
+    const panel = page.getByRole("region", { name: "Entrega da versão" });
+    await expect(panel).toBeVisible();
+    await expect(panel).toContainText(published ? "Confirmada" : "Sem confirmação");
+    await expect(panel).toContainText(closed ? "Concluído" : "Pendente");
+    if (published) await expect(panel).toContainText(fixture.receiptPath);
+    else await expect(panel).not.toContainText(fixture.receiptPath);
+    if (!closed || !published) {
+      assert.ok(delivery.blocker && delivery.next_action);
+      await expect(panel).toContainText(delivery.blocker);
+      await expect(panel).toContainText(delivery.next_action);
+    }
+    if (output) await panel.screenshot({ path: join(output, phase + ".png") });
+    observations.push({
+      phase,
+      pid,
+      publication: delivery.publication,
+      execution: delivery.execution_status,
+      receipt: delivery.receipt_path,
+    });
+  } finally {
+    await context.close();
+  }
+}
+
+try {
+  // Explicit --workspace and a physical Git root keep the parent checkout out of all rebuilds.
+  assert.equal(dirname(await realpath(workspace)), temporary);
+  privateCommand("git", ["init", "--quiet"]);
+  assert.equal(
+    await realpath(privateCommand("git", ["rev-parse", "--show-toplevel"]).trim()),
+    workspace,
+  );
+  if (output) await mkdir(output, { recursive: true });
+  const fixture = await createDeliveryFixture(workspace, createObservabilityFixture);
+  browser = await chromium.launch();
+  const inspect = (phase, published, closed) =>
+    withPreview((origin, pid) => see(origin, pid, fixture, phase, published, closed));
+  refresh();
+  await inspect("missing-issuance", false, false);
+  await fixture.issue();
+  refresh();
+  await inspect("published-open", true, false);
+  await inspect("published-open-after-restart", true, false);
+  assert.notEqual(observations.at(-2).pid, observations.at(-1).pid);
+  await fixture.setExecution("completed");
+  refresh();
+  await inspect("closed", true, true);
+  await fixture.authorize(fixture.otherTaskId);
+  refresh();
+  await inspect("wrong-human-target", false, true);
+  await fixture.authorize();
+  refresh();
+  await fixture.writeReceipt(true);
+  await inspect("tampered-receipt-bytes", false, true);
+  await fixture.writeReceipt();
+  await fixture.authorize(fixture.taskId, false);
+  assert.throws(rebuildManifest, /Human decisions require explicit confirmation provenance/);
+  // Probe the read-only path with a corrupt source that the canonical writer refused.
+  privateCommand(process.execPath, [join(runtime, "scripts/rebuild-sqlite-read-model.mjs")]);
+  await inspect("unconfirmed-human-decision", false, true);
+  const report = JSON.stringify(
+    {
+      node: process.version,
+      chromium: browser.version(),
+      platform: process.platform,
+      fixture: "synthetic loopback",
+      observations,
+    },
+    null,
+    2,
+  );
+  if (output) await writeFile(join(output, "release-dashboard.json"), report + "\n");
+  console.log(report);
+} finally {
+  if (browser) await browser.close();
+  const actual = await realpath(workspace);
+  assert.ok(dirname(actual) === temporary && basename(actual).startsWith("zaip-v76-dashboard-"));
+  await rm(actual, { recursive: true, force: true, maxRetries: 4, retryDelay: 200 });
+}

package/templates/.agents/dashboard/apps/frontend/e2e/release-delivery-receipt.mjs

@@ -0,0 +1,65 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { tsImport } from "tsx/esm/api";
+
+export async function deliveryReceipt(root, task, actor, executionId, humanId) {
+  const { authorizationPayload, issuancePayload, readPostPublicationReceipt, sha } = await tsImport(
+    pathToFileURL(resolve("packages/cli/src/post-publication-receipt.ts")).href,
+    import.meta.url,
+  );
+  const base = {
+    schema_version: 3,
+    kind: "post_publication_closure",
+    actor_task_id: actor.task,
+    actor_execution_id: "EXEC-2026-01-01-00-00-ACTOR-LAB-A001",
+    actor_run_id: actor.run,
+    client_thread_id: "lab-thread",
+    client_turn_id: "lab-turn",
+    human_authorization_sha256: sha("authorized synthetic confirmation"),
+    target_task_id: task.task,
+    target_spec_id: null,
+    target_execution_id: executionId,
+    target_release: "7.6",
+    expected_task_revision: 1,
+    target_change_id: task.change,
+    expected_change_revision: 1,
+    expected_change_status: "blocked",
+    expected_spec_revision: null,
+    expected_spec_status: null,
+    expected_execution_revision: 1,
+    expected_execution_status: "blocked",
+    state_sha256: sha("lab initial state"),
+    proof: {
+      candidate_sha: "1".repeat(40),
+      published_sha: "1".repeat(40),
+      release_url: "https://github.com/zaip-ai/zaip-aios/releases/tag/v7.6",
+      ci_run_id: 101,
+      publish_run_id: 102,
+      cycle_sha256: sha("lab cycle"),
+      proof_content_sha256: sha("lab artifact inventory"),
+      npm_integrity: "sha512-" + Buffer.alloc(64, 1).toString("base64"),
+      release_asset_digest: "sha256:" + sha("lab asset"),
+      release_assets_sha256: sha("lab assets"),
+      evidence_ids: ["EVD-SYNTHETIC-FIXTURE"],
+    },
+    human_decision_id: humanId,
+  };
+  const issuanceId = "DEC-AI-POSTPUB-" + sha(JSON.stringify(base)).slice(0, 24).toUpperCase();
+  const receipt = { ...base, issuance_decision_id: issuanceId };
+  const issuance = JSON.parse(issuancePayload(receipt));
+  const locator =
+    ".agents/private/state/recovery/post-publication/" + issuance.receipt_sha256 + ".json";
+  const path = join(root, locator);
+  await mkdir(dirname(path), { recursive: true });
+  async function write(tampered = false) {
+    const bytes = tampered ? { ...receipt, state_sha256: sha("changed after issuance") } : receipt;
+    await writeFile(path, JSON.stringify(bytes) + "\n");
+    if (!tampered)
+      await readPostPublicationReceipt(
+        { readText: (file) => readFile(join(root, file), "utf8") },
+        locator,
+      );
+  }
+  return { issuanceId, issuance, authorization: authorizationPayload(receipt), write };
+}

package/templates/.agents/dashboard/apps/frontend/index.html

@@ -9,6 +9,7 @@
   </head>
   <body>
     <div id="root"></div>
+    <div id="dashboard-toasts" class="dashboard-toast-stack"></div>
     <script type="module" src="/src/main.tsx"></script>
   </body>
 </html>

package/templates/.agents/dashboard/apps/frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaip-ai/dashboard-frontend",
-  "version": "6.3.0",
+  "version": "7.6.0",
   "private": true,
   "type": "module",
   "scripts": {

package/templates/.agents/dashboard/apps/frontend/playwright.dom.config.ts

@@ -14,10 +14,11 @@ export default defineConfig({
   expect: { timeout: 30_000 },
   use: {
     baseURL: `${baseURL}/?token=e2e-token`,
+    launchOptions: { chromiumSandbox: true },
   },
   projects: [{ name: "chromium", use: { ...devices["Desktop Chrome"] } }],
   webServer: {
-    command: "node .agents/dashboard/packages/local-runtime/dist/server.cjs",
+    command: "node scripts/ci-traceability-server.mjs",
     cwd: workspaceRoot,
     url: `${baseURL}/api/v2/health`,
     reuseExistingServer: false,
@@ -25,7 +26,6 @@ export default defineConfig({
     env: {
       ZAIP_UI_TOKEN: "e2e-token",
       ZAIP_SERVER_PORT: serverPort,
-      ZAIP_WORKSPACE: workspaceRoot,
       ZAIP_UI_ROOT: `${workspaceRoot}/.agents/dashboard/apps/frontend/dist`,
     },
   },

package/templates/.agents/dashboard/apps/frontend/src/AppLoadingPanels.tsx

@@ -1,4 +1,5 @@
 import type { CostLocale } from "@zaip-ai/dashboard-cost-monitor/react";
+import { DashboardToast } from "./DashboardToast.js";
 
 export type LoadingArea = "operations" | "costs" | "traceability";
 
@@ -105,13 +106,15 @@ export function DashboardLoadingNotice({
 }) {
   const copy = loadingCopy(area, locale);
   return (
-    <section aria-live="polite" className="app-refresh-status" role="status">
-      <i />
-      <div>
-        <strong>{copy.title}</strong>
-        <span>{copy.detail}</span>
-      </div>
-    </section>
+    <DashboardToast>
+      <section aria-live="polite" className="app-refresh-status" role="status">
+        <i />
+        <div>
+          <strong>{copy.title}</strong>
+          <span>{copy.detail}</span>
+        </div>
+      </section>
+    </DashboardToast>
   );
 }
 

package/templates/.agents/dashboard/apps/frontend/src/AppOverlays.tsx

@@ -15,6 +15,7 @@ import type { TaskTrace } from "@zaip-ai/dashboard-traceability/contracts";
 import { TaskTraceLoadingPanel, TaskTracePanel } from "@zaip-ai/dashboard-traceability/react";
 import { lazy, Suspense } from "react";
 import { DashboardLoadingNotice, type LoadingArea } from "./AppLoadingPanels.js";
+import { DashboardToast } from "./DashboardToast.js";
 import type { ReconciliationResult } from "./dashboard-api.js";
 import { ReconciliationFeedback } from "./ReconciliationFeedback.js";
 
@@ -169,25 +170,27 @@ export function AppOverlays({
         </div>
       ) : null}
       {refreshDialog === "refreshing" || refreshDialog === "reconciling" ? (
-        <section aria-live="polite" className="app-refresh-status" role="status">
-          <i />
-          <div>
-            <strong>
-              {refreshDialog === "reconciling"
-                ? costLocale === "pt-BR"
-                  ? "Reconciliando itens em aberto…"
-                  : "Reconciling open work…"
-                : costLocale === "pt-BR"
-                  ? "Atualizando dados…"
-                  : "Refreshing data…"}
-            </strong>
-            <span>
-              {costLocale === "pt-BR"
-                ? "Você pode continuar usando o dashboard."
-                : "You can keep using the dashboard."}
-            </span>
-          </div>
-        </section>
+        <DashboardToast>
+          <section aria-live="polite" className="app-refresh-status" role="status">
+            <i />
+            <div>
+              <strong>
+                {refreshDialog === "reconciling"
+                  ? costLocale === "pt-BR"
+                    ? "Reconciliando itens em aberto…"
+                    : "Reconciling open work…"
+                  : costLocale === "pt-BR"
+                    ? "Atualizando dados…"
+                    : "Refreshing data…"}
+              </strong>
+              <span>
+                {costLocale === "pt-BR"
+                  ? "Você pode continuar usando o dashboard."
+                  : "You can keep using the dashboard."}
+              </span>
+            </div>
+          </section>
+        </DashboardToast>
       ) : null}
       {reconciliationResult !== null && refreshDialog === null ? (
         <ReconciliationFeedback