agent-nuvira 2.7.0 → 2.7.2

package/dist/tools/release-sync.js

@@ -10,127 +10,191 @@
  * `vX.Y.Z · N tests` badge, `docs/COMMANDS.md` carries a `nuvira vX.Y.x`
  * header), and NO post-publish diff existed.
  *
- * Deterministic and pure at the core (`findReleaseDrift` — fixture-testable):
- * each release-marker pattern is matched and compared against the CURRENT
- * version; a marker that still names an older version is a gap. Historical
- * "Since v1.60.x" notes are deliberately NOT markers — only the three
- * release-marker patterns below are checked, so nothing false-positives.
+ * P5a.2 — AUTO-FIX: detection alone left the fix to a human (or a lucky
+ * agent turn). Since every marker is a NARROW, version-bearing regex, the
+ * fix is deterministic: rewrite the stale version token, keep everything
+ * else byte-identical, then RE-DETECT on the result (a fix that does not
+ * verify is reported as failed, never silently claimed). `runReleaseSync`
+ * now fixes by default; `reportOnly` opts out. File writes are surgical
+ * (target file, matched span only) and failures are best-effort — a sync
+ * failure must never mark the publish failed.
+ *
+ * Deterministic and pure at the core (`findReleaseDrift` / `fixReleaseDrift`
+ * — fixture-testable): each release-marker pattern is matched and compared
+ * against the CURRENT version; a marker that still names an older version is
+ * a gap. Historical "Since v1.60.x" notes are deliberately NOT markers —
+ * only the three release-marker patterns below are checked, so nothing
+ * false-positives.
  *
  * Best-effort by construction: a missing/unreadable sync target, or an
  * emission failure, never throws — a sync check failure must never mark the
  * publish failed (the brief's hard rule).
  */
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 /** The sync targets scanned after a publish (relative to the workspace root). */
 export const SYNC_TARGETS = ['website/index.html', 'docs/COMMANDS.md'];
+const RELEASE_MARKERS = [
+    {
+        kind: 'current-release',
+        // Marker 1 — the website's "Current release" callout.
+        pattern: /Current release <strong>v(\d+\.\d+\.\d+)<\/strong>/g,
+        render: (_full, stale, fixed) => _full.replace(`v${stale}`, `v${fixed}`),
+    },
+    {
+        kind: 'test-count-badge',
+        // Marker 2 — the arch-tier "vX.Y.Z · N tests" badge (N is comma-grouped).
+        pattern: /v(\d+\.\d+\.\d+) · [\d,]+ tests/g,
+        render: (_full, stale, fixed) => _full.replace(`v${stale}`, `v${fixed}`),
+    },
+    {
+        kind: 'cli-version-header',
+        // Marker 3 — the docs "`buff` vX.Y.x" / "`nuvira` vX.Y.x" CLI header
+        // (major.minor only). COMMANDS.md has used both binary names.
+        pattern: /`?(?:buff|nuvira)`? v(\d+\.\d+)\.x/g,
+        render: (_full, stale, fixed) => _full.replace(`v${stale}.x`, `v${fixed}.x`),
+    },
+];
+/** 1-based line number of a character offset. */
+function lineNumberAt(text, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < text.length; i++) {
+        if (text[i] === '\n')
+            line++;
+    }
+    return line;
+}
 /**
  * Pure drift detector — the testable core. Scans one file's text for the
  * release-marker patterns and returns every marker whose version does NOT
  * match the current (published) version. Never throws.
- *
- * Markers (deliberately narrow — historical notes are not markers):
- *   1. `Current release <strong>vX.Y.Z</strong>`        → exact version
- *   2. `vX.Y.Z · N tests` (the arch-tier badge)          → exact version
- *   3. `nuvira vX.Y.x` (COMMANDS.md header)                → major.minor only
  */
 export function findReleaseDrift(text, file, currentVersion) {
     const gaps = [];
     const clean = currentVersion.trim().replace(/^v/, '');
     const expectedExact = `v${clean}`;
     const expectedMajorMinor = clean.split('.').slice(0, 2).join('.');
-    // Marker 1 — the website's "Current release" callout.
-    const currentRe = /Current release <strong>v(\d+\.\d+\.\d+)<\/strong>/g;
-    let m;
-    while ((m = currentRe.exec(text)) !== null) {
-        const found = m[1];
-        if (found !== clean) {
-            gaps.push({
-                file,
-                line: lineNumberAt(text, m.index),
-                found: `v${found}`,
-                expected: expectedExact,
-                kind: 'current-release',
-            });
-        }
-    }
-    // Marker 2 — the arch-tier "vX.Y.Z · N tests" badge (N is comma-grouped,
-    // e.g. "4,556 tests").
-    const badgeRe = /v(\d+\.\d+\.\d+) · [\d,]+ tests/g;
-    while ((m = badgeRe.exec(text)) !== null) {
-        const found = m[1];
-        if (found !== clean) {
-            gaps.push({
-                file,
-                line: lineNumberAt(text, m.index),
-                found: `v${found}`,
-                expected: expectedExact,
-                kind: 'test-count-badge',
-            });
-        }
-    }
-    // Marker 3 — the docs "`buff` vX.Y.x" / "`nuvira` vX.Y.x" CLI header
-    // (major.minor only). COMMANDS.md has used both binary names
-    // ("`nuvira` v1.74.x" observed live); tolerate backticked or bare.
-    const cliRe = /`?(buff|nuvira)`? v(\d+\.\d+)\.x/g;
-    while ((m = cliRe.exec(text)) !== null) {
-        const found = m[2];
-        if (found !== expectedMajorMinor) {
-            gaps.push({
-                file,
-                line: lineNumberAt(text, m.index),
-                found: `v${found}.x`,
-                expected: `v${expectedMajorMinor}.x`,
-                kind: 'cli-version-header',
-            });
+    for (const marker of RELEASE_MARKERS) {
+        marker.pattern.lastIndex = 0;
+        let m;
+        while ((m = marker.pattern.exec(text)) !== null) {
+            const found = m[1];
+            const stale = marker.kind === 'cli-version-header'
+                ? found !== expectedMajorMinor
+                : found !== clean;
+            if (stale) {
+                gaps.push({
+                    file,
+                    line: lineNumberAt(text, m.index),
+                    found: marker.kind === 'cli-version-header' ? `v${found}.x` : `v${found}`,
+                    expected: marker.kind === 'cli-version-header' ? `v${expectedMajorMinor}.x` : expectedExact,
+                    kind: marker.kind,
+                });
+            }
         }
     }
     return gaps;
 }
-/** 1-based line number of a character offset. */
-function lineNumberAt(text, index) {
-    let line = 1;
-    for (let i = 0; i < index && i < text.length; i++) {
-        if (text[i] === '\n')
-            line++;
+/**
+ * P5a.2 — pure marker patcher. Rewrites ONLY the stale version tokens of the
+ * release markers in `text` to `currentVersion`; every other byte is kept.
+ * Deterministic: same input + version → same output. Companion to
+ * `findReleaseDrift` (shared marker table), so anything detection would flag,
+ * the patcher fixes — and vice versa.
+ */
+export function fixReleaseDrift(text, currentVersion) {
+    const clean = currentVersion.trim().replace(/^v/, '');
+    const expectedMajorMinor = clean.split('.').slice(0, 2).join('.');
+    let out = text;
+    for (const marker of RELEASE_MARKERS) {
+        marker.pattern.lastIndex = 0;
+        out = out.replace(marker.pattern, (full, stale) => {
+            const fixed = marker.kind === 'cli-version-header' ? expectedMajorMinor : clean;
+            return stale === fixed ? full : marker.render(full, stale, fixed);
+        });
     }
-    return line;
+    return out;
 }
 /** Read a sync target's text (empty string when missing/unreadable). */
 function readTarget(root, target) {
     try {
         const p = join(root, target);
-        return existsSync(p) ? readFileSync(p, 'utf-8') : '';
+        if (!existsSync(p))
+            return { text: '', ok: false };
+        return { text: readFileSync(p, 'utf-8'), ok: true };
     }
     catch {
-        return '';
+        return { text: '', ok: false };
+    }
+}
+/** Write a sync target (false on any failure — reported, never thrown). */
+function writeTarget(root, target, text) {
+    try {
+        writeFileSync(join(root, target), text, 'utf-8');
+        return true;
+    }
+    catch {
+        return false;
     }
 }
 /**
- * Run the post-publish sync check: scan every sync target under the
- * workspace root for stale release markers vs the published version. Emits a
- * structured `release:sync` event (best-effort) so a future GUI card can
- * render the gaps with an offer-to-fix. Returns a model-feedable summary —
- * never throws.
+ * P5a.2 — run the post-publish sync pass with AUTO-FIX. Detects drift,
+ * patches every stale marker, re-reads and RE-DETECTS to verify, and emits a
+ * structured `release:sync` event. `reportOnly: true` restores the old
+ * detect-only behavior. Returns a model-feedable summary — never throws.
  */
-export function runReleaseSync(currentVersion, ctx) {
+export function runReleaseSync(currentVersion, ctx, opts) {
     const root = ctx.cwd || process.cwd();
     const clean = currentVersion.trim().replace(/^v/, '');
+    const reportOnly = opts?.reportOnly === true;
     const gaps = [];
+    const fixes = [];
+    const errors = [];
     for (const target of SYNC_TARGETS) {
-        const text = readTarget(root, target);
-        if (!text)
+        const read = readTarget(root, target);
+        if (!read.ok || !read.text)
             continue; // a missing target is not a gap — best-effort
-        gaps.push(...findReleaseDrift(text, target, clean));
+        const found = findReleaseDrift(read.text, target, clean);
+        gaps.push(...found);
+        if (found.length === 0 || reportOnly)
+            continue;
+        const fixedText = fixReleaseDrift(read.text, clean);
+        if (!writeTarget(root, target, fixedText)) {
+            errors.push(`${target}: write failed (read-only checkout?) — fix manually or commit the version bump first.`);
+            continue;
+        }
+        // Verify: re-read the file we just wrote and re-detect. A fix that does
+        // not verify is reported as failed — never silently claimed as done.
+        const verify = readTarget(root, target);
+        const remaining = verify.ok ? findReleaseDrift(verify.text, target, clean) : found;
+        for (const gap of found) {
+            const stillThere = remaining.some((r) => r.kind === gap.kind && r.line === gap.line);
+            fixes.push({ file: gap.file, line: gap.line, kind: gap.kind, found: gap.found, expected: gap.expected, verified: !stillThere });
+        }
+    }
+    const fixedCount = fixes.filter((f) => f.verified).length;
+    const failedCount = fixes.filter((f) => !f.verified).length;
+    const synced = gaps.length === 0 || (reportOnly === false && failedCount === 0 && errors.length === 0);
+    try {
+        ctx.emit?.('release:sync', { version: clean, gaps, fixes, synced, reportOnly, errors });
+    }
+    catch {
+        /* best-effort — the text summary below still ships */
     }
     if (gaps.length === 0) {
-        ctx.emit?.('release:sync', { version: clean, gaps: [], synced: true });
         return `✅ Release-sync: website/docs already at v${clean} — no version drift.`;
     }
-    const lines = gaps.map((g) => `  • ${g.file}:${g.line} — ${g.kind} shows ${g.found}, should be ${g.expected}`);
-    ctx.emit?.('release:sync', { version: clean, gaps, synced: false });
-    return (`⚠️  Release-sync: ${gaps.length} stale release marker(s) after publishing v${clean}:\n` +
-        lines.join('\n') +
-        `\nOffer to fix them (ask_user → edit_file) so the website/docs stay at the release level.`);
+    if (reportOnly) {
+        const lines = gaps.map((g) => `  • ${g.file}:${g.line} — ${g.kind} shows ${g.found}, should be ${g.expected}`);
+        return (`⚠️  Release-sync: ${gaps.length} stale release marker(s) vs v${clean}:\n` +
+            lines.join('\n') +
+            `\nOffer to fix them (ask_user → edit_file) so the website/docs stay at the release level.`);
+    }
+    const fixLines = fixes.map((f) => `  • ${f.file}:${f.line} — ${f.kind} ${f.found} → ${f.expected}${f.verified ? ' ✅' : ' ❌ verify failed'}`);
+    const errorLines = errors.length > 0 ? `\n⚠️ ${errors.join('\n⚠️ ')}` : '';
+    const status = failedCount === 0 && errors.length === 0
+        ? `✅ Release-sync auto-fixed ${fixedCount} stale marker(s) for v${clean} — verified by re-scan.`
+        : `⚠️  Release-sync: ${fixedCount} fixed, ${failedCount} failed for v${clean}:`;
+    return `${status}\n${fixLines.join('\n')}${errorLines}`;
 }
 //# sourceMappingURL=release-sync.js.map

package/dist/tools/release-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-sync.js","sourceRoot":"","sources":["../../src/tools/release-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAkBjC,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;AAEvE;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAY,EAAE,cAAsB;IACjF,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,KAAK,EAAE,CAAC;IAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElE,sDAAsD;IACtD,MAAM,SAAS,GAAG,qDAAqD,CAAC;IACxE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI;gBACJ,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;gBACjC,KAAK,EAAE,IAAI,KAAK,EAAE;gBAClB,QAAQ,EAAE,aAAa;gBACvB,IAAI,EAAE,iBAAiB;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,uBAAuB;IACvB,MAAM,OAAO,GAAG,kCAAkC,CAAC;IACnD,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI;gBACJ,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;gBACjC,KAAK,EAAE,IAAI,KAAK,EAAE;gBAClB,QAAQ,EAAE,aAAa;gBACvB,IAAI,EAAE,kBAAkB;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,6DAA6D;IAC7D,mEAAmE;IACnE,MAAM,KAAK,GAAG,mCAAmC,CAAC;IAClD,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,KAAK,KAAK,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI;gBACJ,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;gBACjC,KAAK,EAAE,IAAI,KAAK,IAAI;gBACpB,QAAQ,EAAE,IAAI,kBAAkB,IAAI;gBACpC,IAAI,EAAE,oBAAoB;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iDAAiD;AACjD,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,cAAsB,EAAE,GAAgB;IACrE,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAsB,EAAE,CAAC;IAEnC,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,SAAS,CAAC,8CAA8C;QACnE,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,OAAO,4CAA4C,KAAK,sBAAsB,CAAC;IACjF,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,QAAQ,EAAE,CACvF,CAAC;IACF,GAAG,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,OAAO,CACL,qBAAqB,IAAI,CAAC,MAAM,8CAA8C,KAAK,KAAK;QACxF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAChB,2FAA2F,CAC5F,CAAC;AACJ,CAAC"}
+{"version":3,"file":"release-sync.js","sourceRoot":"","sources":["../../src/tools/release-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAkBjC,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;AAmCvE,MAAM,eAAe,GAAoB;IACvC;QACE,IAAI,EAAE,iBAAiB;QACvB,sDAAsD;QACtD,OAAO,EAAE,qDAAqD;QAC9D,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,IAAI,KAAK,EAAE,CAAC;KACzE;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,0EAA0E;QAC1E,OAAO,EAAE,kCAAkC;QAC3C,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,IAAI,KAAK,EAAE,CAAC;KACzE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,qEAAqE;QACrE,8DAA8D;QAC9D,OAAO,EAAE,qCAAqC;QAC9C,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;KAC7E;CACF,CAAC;AAEF,iDAAiD;AACjD,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAY,EAAE,cAAsB;IACjF,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,KAAK,EAAE,CAAC;IAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElE,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GACT,MAAM,CAAC,IAAI,KAAK,oBAAoB;gBAClC,CAAC,CAAC,KAAK,KAAK,kBAAkB;gBAC9B,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;YACtB,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI;oBACJ,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;oBACjC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE;oBACzE,QAAQ,EAAE,MAAM,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,kBAAkB,IAAI,CAAC,CAAC,CAAC,aAAa;oBAC3F,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,cAAsB;IAClE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC7B,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAa,EAAE,EAAE;YACxD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC;YAChF,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,IAAY;IAC7D,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,cAAsB,EACtB,GAAgB,EAChB,IAA+B;IAE/B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,SAAS,CAAC,8CAA8C;QAEpF,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAEpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU;YAAE,SAAS;QAE/C,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,uFAAuF,CAAC,CAAC;YAC9G,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACnF,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAClD,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAClI,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,IAAI,WAAW,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAEvG,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,4CAA4C,KAAK,sBAAsB,CAAC;IACjF,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,QAAQ,EAAE,CACvF,CAAC;QACF,OAAO,CACL,qBAAqB,IAAI,CAAC,MAAM,gCAAgC,KAAK,KAAK;YAC1E,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAChB,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CACxB,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAC5G,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,MAAM,GACV,WAAW,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACtC,CAAC,CAAC,6BAA6B,UAAU,yBAAyB,KAAK,yBAAyB;QAChG,CAAC,CAAC,qBAAqB,UAAU,WAAW,WAAW,gBAAgB,KAAK,GAAG,CAAC;IAEpF,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC;AAC1D,CAAC"}

package/dist/web-dashboard/src/App.js

@@ -0,0 +1,85 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = App;
+const react_1 = require("react");
+const react_router_dom_1 = require("react-router-dom");
+const api_1 = require("./api");
+const Layout_1 = __importDefault(require("./components/Layout"));
+const Overview_1 = __importDefault(require("./components/Overview"));
+const DAGView_1 = __importDefault(require("./components/DAGView"));
+const CostDashboard_1 = __importDefault(require("./components/CostDashboard"));
+const BenchmarkCharts_1 = __importDefault(require("./components/BenchmarkCharts"));
+const HealthPanel_1 = __importDefault(require("./components/HealthPanel"));
+const ModelsPanel_1 = __importDefault(require("./components/ModelsPanel"));
+const RoutingInsightsPanel_1 = __importDefault(require("./components/RoutingInsightsPanel"));
+const RequestsPanel_1 = __importDefault(require("./components/RequestsPanel"));
+const TracePanel_1 = __importDefault(require("./components/TracePanel"));
+const AdminPanel_1 = __importDefault(require("./components/AdminPanel"));
+const AgentHub_1 = __importDefault(require("./components/AgentHub"));
+const TasksPage_1 = __importDefault(require("./components/TasksPage"));
+const ChatPage_1 = __importDefault(require("./components/ChatPage"));
+const EvalsPage_1 = __importDefault(require("./components/EvalsPage"));
+const GatewayPage_1 = __importDefault(require("./components/GatewayPage"));
+const PlatformsPage_1 = __importDefault(require("./components/PlatformsPage"));
+const BedrockOnboarding_1 = __importDefault(require("./components/BedrockOnboarding"));
+const ContactsPage_1 = __importDefault(require("./components/ContactsPage"));
+const ModelTimeline_1 = __importDefault(require("./components/ModelTimeline"));
+function App() {
+    const [data, setData] = (0, react_1.useState)(null);
+    const [connected, setConnected] = (0, react_1.useState)(false);
+    const [lastUpdated, setLastUpdated] = (0, react_1.useState)('--');
+    const handleData = (0, react_1.useCallback)((d) => {
+        setData(d);
+        setLastUpdated(new Date().toLocaleTimeString());
+    }, []);
+    const handleConnection = (0, react_1.useCallback)((c) => {
+        setConnected(c);
+    }, []);
+    (0, react_1.useEffect)(() => {
+        // Fetch initial data
+        api_1.dashboardAPI.fetchAll().then((d) => {
+            if (d)
+                handleData(d);
+        });
+        // Subscribe to SSE updates
+        const unsubData = api_1.dashboardAPI.subscribe(handleData);
+        const unsubConn = api_1.dashboardAPI.onConnectionChange(handleConnection);
+        api_1.dashboardAPI.connect();
+        return () => {
+            unsubData();
+            unsubConn();
+            api_1.dashboardAPI.disconnect();
+        };
+    }, [handleData, handleConnection]);
+    return (<Layout_1.default connected={connected} lastUpdated={lastUpdated}>
+      <react_router_dom_1.Routes>
+        {/* Phase 5 — Chat is the front door; Overview (and every other room)
+            stays reachable as a panel, never required. */}
+        <react_router_dom_1.Route path="/" element={<ChatPage_1.default />}/>
+        <react_router_dom_1.Route path="/overview" element={<Overview_1.default data={data}/>}/>
+        <react_router_dom_1.Route path="/chat" element={<react_router_dom_1.Navigate to="/" replace/>}/>
+        <react_router_dom_1.Route path="/dag" element={<DAGView_1.default data={data}/>}/>
+        <react_router_dom_1.Route path="/costs" element={<CostDashboard_1.default data={data}/>}/>
+        <react_router_dom_1.Route path="/benchmarks" element={<BenchmarkCharts_1.default data={data}/>}/>
+        <react_router_dom_1.Route path="/models" element={<ModelsPanel_1.default />}/>
+        <react_router_dom_1.Route path="/models/timeline" element={<ModelTimeline_1.default />}/>
+        <react_router_dom_1.Route path="/routing" element={<RoutingInsightsPanel_1.default data={data}/>}/>
+        <react_router_dom_1.Route path="/requests" element={<RequestsPanel_1.default data={data}/>}/>
+        <react_router_dom_1.Route path="/traces" element={<TracePanel_1.default />}/>
+        <react_router_dom_1.Route path="/hub" element={<AgentHub_1.default />}/>
+        <react_router_dom_1.Route path="/tasks" element={<TasksPage_1.default />}/>
+        <react_router_dom_1.Route path="/chat" element={<ChatPage_1.default />}/>
+        <react_router_dom_1.Route path="/evals" element={<EvalsPage_1.default data={data}/>}/>
+        <react_router_dom_1.Route path="/platforms" element={<PlatformsPage_1.default />}/>
+        <react_router_dom_1.Route path="/bedrock" element={<BedrockOnboarding_1.default canWrite={true} sessionExpired={(msg) => console.error(msg)}/>}/>
+        <react_router_dom_1.Route path="/contacts" element={<ContactsPage_1.default />}/>
+        <react_router_dom_1.Route path="/gateway" element={<GatewayPage_1.default />}/>
+        <react_router_dom_1.Route path="/system" element={<HealthPanel_1.default data={data}/>}/>
+        <react_router_dom_1.Route path="/admin" element={<AdminPanel_1.default />}/>
+        <react_router_dom_1.Route path="*" element={<react_router_dom_1.Navigate to="/" replace/>}/>
+      </react_router_dom_1.Routes>
+    </Layout_1.default>);
+}

package/dist/web-dashboard/src/admin-auth.test.js

@@ -0,0 +1,186 @@
+"use strict";
+/**
+ * Admin-auth module tests (Sessions 18 + 19).
+ *
+ * Session 18: the user-id + password gate (scrypt, env override, Bearer
+ * sessions). Session 19: multi-user + RBAC roles — the credential file stores
+ * a users map with roles, rbac.json assignments override the stored role (CLI
+ * governance parity), and sessions carry the acting role. These tests pin the
+ * security properties: passwords never on disk, wrong passwords fail, legacy
+ * single-user files migrate, rbac wins over the stored role, and the last
+ * admin can't be removed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const paths_1 = require("../../config/paths");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const admin_auth_1 = require("./admin-auth");
+(0, vitest_1.describe)('hashAdminPassword / verifyAdminPassword', () => {
+    (0, vitest_1.it)('round-trips a password (unique salt per hash)', () => {
+        const a = (0, admin_auth_1.hashAdminPassword)('s3cret-pass');
+        const b = (0, admin_auth_1.hashAdminPassword)('s3cret-pass');
+        (0, vitest_1.expect)(a.salt).not.toBe(b.salt);
+        (0, vitest_1.expect)((0, admin_auth_1.verifyAdminPassword)('s3cret-pass', a.salt, a.hash)).toBe(true);
+    });
+    (0, vitest_1.it)('rejects a wrong password and a wrong salt', () => {
+        const { salt, hash } = (0, admin_auth_1.hashAdminPassword)('right-password');
+        (0, vitest_1.expect)((0, admin_auth_1.verifyAdminPassword)('wrong-password', salt, hash)).toBe(false);
+        (0, vitest_1.expect)((0, admin_auth_1.verifyAdminPassword)('right-password', 'ffffffffffffffff', hash)).toBe(false);
+    });
+});
+(0, vitest_1.describe)('multi-user credential store (config-dir scoped)', () => {
+    let dir;
+    (0, vitest_1.beforeEach)(() => {
+        dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'buff-admin-auth-'));
+    });
+    (0, vitest_1.afterEach)(() => {
+        (0, node_fs_1.rmSync)(dir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('stores users with roles — passwords never on disk', () => {
+        const admin = (0, admin_auth_1.writeAdminUser)('admin', 'super-secret-pass', 'admin', dir);
+        (0, vitest_1.expect)(admin.role).toBe('admin');
+        const op = (0, admin_auth_1.writeAdminUser)('op', 'operator-pass-1', 'operator', dir);
+        (0, vitest_1.expect)(op.role).toBe('operator');
+        const raw = (0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, 'dashboard-admin.json'), 'utf-8');
+        (0, vitest_1.expect)(raw).not.toContain('super-secret-pass');
+        (0, vitest_1.expect)(raw).not.toContain('operator-pass-1');
+        const users = (0, admin_auth_1.readAdminUsers)(dir);
+        (0, vitest_1.expect)(Object.keys(users).sort()).toEqual(['admin', 'op']);
+        (0, vitest_1.expect)(users.admin.role).toBe('admin');
+        (0, vitest_1.expect)(users.op.role).toBe('operator');
+        (0, vitest_1.expect)((0, admin_auth_1.verifyAdmin)('admin', 'super-secret-pass', dir)).toBe(true);
+        (0, vitest_1.expect)((0, admin_auth_1.verifyAdmin)('op', 'operator-pass-1', dir)).toBe(true);
+        (0, vitest_1.expect)((0, admin_auth_1.verifyAdmin)('admin', 'wrong', dir)).toBe(false);
+        (0, vitest_1.expect)((0, admin_auth_1.verifyAdmin)('ghost', 'super-secret-pass', dir)).toBe(false);
+        (0, vitest_1.expect)((0, admin_auth_1.isAdminConfigured)(dir)).toBe(true);
+    });
+    (0, vitest_1.it)('listAdminUsers excludes salt/hash; removeAdminUser deletes; countAdminRoleUsers counts admins', () => {
+        (0, admin_auth_1.writeAdminUser)('admin', 'admin-pass-123', 'admin', dir);
+        (0, admin_auth_1.writeAdminUser)('op', 'operator-pass-1', 'operator', dir);
+        (0, admin_auth_1.writeAdminUser)('view', 'viewer-pass-12', 'viewer', dir);
+        const listed = (0, admin_auth_1.listAdminUsers)(dir);
+        (0, vitest_1.expect)(listed).toHaveLength(3);
+        for (const u of listed) {
+            (0, vitest_1.expect)(u).not.toHaveProperty('salt');
+            (0, vitest_1.expect)(u).not.toHaveProperty('hash');
+        }
+        (0, vitest_1.expect)((0, admin_auth_1.countAdminRoleUsers)(dir)).toBe(1);
+        (0, vitest_1.expect)((0, admin_auth_1.removeAdminUser)('op', dir)).toBe(true);
+        (0, vitest_1.expect)((0, admin_auth_1.removeAdminUser)('op', dir)).toBe(false);
+        (0, vitest_1.expect)((0, admin_auth_1.listAdminUsers)(dir).map((u) => u.user)).toEqual(['admin', 'view']);
+    });
+    (0, vitest_1.it)('migrates the legacy single-user file shape to an admin user', () => {
+        // Session 18 shape: { user, salt, hash, createdAt } (no users wrapper).
+        const { salt, hash } = (0, admin_auth_1.hashAdminPassword)('legacy-pass');
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'dashboard-admin.json'), JSON.stringify({ user: 'admin', salt, hash, createdAt: 123 }), 'utf-8');
+        const users = (0, admin_auth_1.readAdminUsers)(dir);
+        (0, vitest_1.expect)(users.admin.role).toBe('admin');
+        (0, vitest_1.expect)((0, admin_auth_1.verifyAdmin)('admin', 'legacy-pass', dir)).toBe(true);
+        (0, vitest_1.expect)((0, admin_auth_1.isAdminConfigured)(dir)).toBe(true);
+    });
+    (0, vitest_1.it)('a corrupt file reads as unconfigured (never throws, never downgrades to open)', () => {
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'dashboard-admin.json'), '{not json', 'utf-8');
+        (0, vitest_1.expect)((0, admin_auth_1.readAdminUsers)(dir)).toBeNull();
+        (0, vitest_1.expect)((0, admin_auth_1.isAdminConfigured)(dir)).toBe(false);
+        (0, vitest_1.expect)((0, admin_auth_1.verifyAdmin)('admin', 'anything', dir)).toBe(false);
+    });
+});
+(0, vitest_1.describe)('roleForUser — rbac.json wins over the stored role (CLI parity)', () => {
+    let dir;
+    (0, vitest_1.beforeEach)(() => {
+        dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'buff-admin-auth-'));
+    });
+    (0, vitest_1.afterEach)(() => {
+        (0, node_fs_1.rmSync)(dir, { recursive: true, force: true });
+    });
+    (0, vitest_1.it)('uses the credential role when rbac.json has no assignment', () => {
+        (0, admin_auth_1.writeAdminUser)('op', 'operator-pass-1', 'operator', dir);
+        (0, vitest_1.expect)((0, admin_auth_1.roleForUser)('op', dir)).toBe('operator');
+    });
+    (0, vitest_1.it)('an rbac.json assignment overrides the stored role (a viewer in rbac is a viewer here)', () => {
+        (0, admin_auth_1.writeAdminUser)('op', 'operator-pass-1', 'operator', dir);
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'rbac.json'), JSON.stringify({ version: 1, users: { op: { role: 'viewer', addedAt: Date.now(), via: 'local' } } }), 'utf-8');
+        // rbac wins: the dashboard cannot escalate a user the CLI governs as viewer.
+        (0, vitest_1.expect)((0, admin_auth_1.roleForUser)('op', dir)).toBe('viewer');
+    });
+    (0, vitest_1.it)('unknown users resolve to viewer (deny by default)', () => {
+        (0, vitest_1.expect)((0, admin_auth_1.roleForUser)('ghost', dir)).toBe('viewer');
+    });
+});
+(0, vitest_1.describe)('env override (with role)', () => {
+    const OLD = {
+        user: (0, paths_1.envBuff)('DASHBOARD_ADMIN_USER'),
+        pass: (0, paths_1.envBuff)('DASHBOARD_ADMIN_PASSWORD'),
+        role: (0, paths_1.envBuff)('DASHBOARD_ADMIN_ROLE'),
+    };
+    (0, vitest_1.afterEach)(() => {
+        for (const [k, v] of Object.entries(OLD)) {
+            if (v === undefined)
+                delete process.env[`BUFF_DASHBOARD_ADMIN_${k.toUpperCase()}`];
+            else
+                process.env[`BUFF_DASHBOARD_ADMIN_${k.toUpperCase()}`] = v;
+        }
+    });
+    (0, vitest_1.it)('password-only defaults to the admin user + admin role; env wins over the file', () => {
+        delete (0, paths_1.envBuff)('DASHBOARD_ADMIN_USER');
+        delete (0, paths_1.envBuff)('DASHBOARD_ADMIN_ROLE');
+        (0, paths_1.envBuff)('DASHBOARD_ADMIN_PASSWORD') = 'env-pass';
+        (0, vitest_1.expect)((0, admin_auth_1.envAdminOverride)()).toEqual({ user: 'admin', password: 'env-pass', role: 'admin' });
+        (0, vitest_1.expect)((0, admin_auth_1.isAdminConfigured)()).toBe(true);
+        (0, vitest_1.expect)((0, admin_auth_1.verifyAdmin)('admin', 'env-pass')).toBe(true);
+        (0, vitest_1.expect)((0, admin_auth_1.verifyAdmin)('admin', 'file-pass')).toBe(false);
+    });
+    (0, vitest_1.it)('honors BUFF_DASHBOARD_ADMIN_ROLE and rejects an invalid one (falls back to admin)', () => {
+        delete (0, paths_1.envBuff)('DASHBOARD_ADMIN_USER');
+        (0, paths_1.envBuff)('DASHBOARD_ADMIN_PASSWORD') = 'env-pass';
+        (0, paths_1.envBuff)('DASHBOARD_ADMIN_ROLE') = 'operator';
+        (0, vitest_1.expect)((0, admin_auth_1.envAdminOverride)()?.role).toBe('operator');
+        (0, paths_1.envBuff)('DASHBOARD_ADMIN_ROLE') = 'superuser';
+        (0, vitest_1.expect)((0, admin_auth_1.envAdminOverride)()?.role).toBe('admin');
+    });
+    (0, vitest_1.it)('roleForUser honors the env override role even with NO credential file (regression — env admins are not viewers)', () => {
+        delete (0, paths_1.envBuff)('DASHBOARD_ADMIN_USER');
+        (0, paths_1.envBuff)('DASHBOARD_ADMIN_ROLE') = 'admin';
+        (0, paths_1.envBuff)('DASHBOARD_ADMIN_PASSWORD') = 'env-pass';
+        // No dashboard-admin.json exists anywhere — the env role must still apply.
+        (0, vitest_1.expect)((0, admin_auth_1.roleForUser)('admin')).toBe('admin');
+        (0, vitest_1.expect)((0, admin_auth_1.roleForUser)('someone-else')).toBe('viewer');
+    });
+});
+(0, vitest_1.describe)('AdminSessions (role-carrying)', () => {
+    (0, vitest_1.it)('issues and validates a token with its role, rejects garbage', () => {
+        const s = new admin_auth_1.AdminSessions();
+        const token = s.issue('admin', 'admin');
+        (0, vitest_1.expect)(s.validate(token)).toEqual({ user: 'admin', role: 'admin' });
+        (0, vitest_1.expect)(s.validate('nope')).toBeNull();
+        (0, vitest_1.expect)(s.validate(undefined)).toBeNull();
+        (0, vitest_1.expect)(s.size()).toBe(1);
+    });
+    (0, vitest_1.it)('revokes a token', () => {
+        const s = new admin_auth_1.AdminSessions();
+        const token = s.issue('op', 'operator');
+        (0, vitest_1.expect)(s.revoke(token)).toBe(true);
+        (0, vitest_1.expect)(s.validate(token)).toBeNull();
+        (0, vitest_1.expect)(s.size()).toBe(0);
+    });
+    (0, vitest_1.it)('rejects expired tokens and reaps them', () => {
+        const s = new admin_auth_1.AdminSessions();
+        const token = s.issue('admin', 'admin');
+        vitest_1.vi.useFakeTimers();
+        try {
+            vitest_1.vi.advanceTimersByTime(8 * 60 * 60 * 1000 + 1);
+            (0, vitest_1.expect)(s.validate(token)).toBeNull();
+            (0, vitest_1.expect)(s.size()).toBe(0);
+        }
+        finally {
+            vitest_1.vi.useRealTimers();
+        }
+    });
+});
+(0, vitest_1.describe)('MIN_ADMIN_PASSWORD_LENGTH', () => {
+    (0, vitest_1.it)('is enforced by the server-facing constant (8 chars)', () => {
+        (0, vitest_1.expect)(admin_auth_1.MIN_ADMIN_PASSWORD_LENGTH).toBe(8);
+    });
+});

package/dist/web-dashboard/src/ansi.js

@@ -0,0 +1,23 @@
+"use strict";
+/**
+ * P2 — ANSI escape stripping for terminal output rendered in the dashboard.
+ *
+ * The P1 task runner streams a child process's RAW stdout/stderr — chalk
+ * colors, cursor-control (progress bars / spinners), and OSC window-title
+ * sequences all arrive intact. The task-run card must render clean text, so
+ * every escape sequence is removed here (pure string in → string out).
+ *
+ * Coverage:
+ *   - CSI sequences  ESC [ ... (params) (intermediates) final  — `\x1b[32m`,
+ *     `\x1b[2K` (clear line), `\x1b[1A` (cursor up), `\x1b[?25l` (hide cursor)
+ *   - OSC sequences  ESC ] ... BEL|ST                        — `\x1b]0;title\x07`
+ *   - Single-char escapes                                     — `\x1b7` etc.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripAnsi = stripAnsi;
+const ANSI_PATTERN = /\x1b(?:\[[0-9;?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-Z\\-_])/g;
+function stripAnsi(text) {
+    if (!text)
+        return '';
+    return text.replace(ANSI_PATTERN, '');
+}

package/dist/web-dashboard/src/ansi.test.js

@@ -0,0 +1,31 @@
+"use strict";
+/**
+ * P2 — ANSI escape stripping unit tests: the pure string→string function the
+ * task-run card uses to render child-process output without chalk colors,
+ * cursor-control, or OSC window-title sequences.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const ansi_1 = require("./ansi");
+(0, vitest_1.describe)('stripAnsi', () => {
+    (0, vitest_1.it)('removes SGR color codes (single and multi-param)', () => {
+        (0, vitest_1.expect)((0, ansi_1.stripAnsi)('\x1b[32mgreen\x1b[0m')).toBe('green');
+        (0, vitest_1.expect)((0, ansi_1.stripAnsi)('\x1b[38;2;255;0;0m rgb \x1b[39m')).toBe(' rgb ');
+    });
+    (0, vitest_1.it)('removes cursor-control and clear-line sequences (progress bars)', () => {
+        (0, vitest_1.expect)((0, ansi_1.stripAnsi)('\x1b[2K\x1b[1A\x1b[2Kprogress 50%')).toBe('progress 50%');
+        (0, vitest_1.expect)((0, ansi_1.stripAnsi)('\x1b[?25l\x1b[?25h')).toBe('');
+    });
+    (0, vitest_1.it)('removes OSC window-title sequences', () => {
+        (0, vitest_1.expect)((0, ansi_1.stripAnsi)('\x1b]0;my title\x07content')).toBe('content');
+        (0, vitest_1.expect)((0, ansi_1.stripAnsi)('\x1b]0;another\x1b\\tail')).toBe('tail');
+    });
+    (0, vitest_1.it)('leaves plain text untouched', () => {
+        (0, vitest_1.expect)((0, ansi_1.stripAnsi)('plain output 123')).toBe('plain output 123');
+        (0, vitest_1.expect)((0, ansi_1.stripAnsi)('')).toBe('');
+    });
+    (0, vitest_1.it)('handles mixed lines with multiple sequences', () => {
+        const line = '\x1b[1mBOLD\x1b[22m \x1b[31mRED\x1b[0m \x1b[2Kdone';
+        (0, vitest_1.expect)((0, ansi_1.stripAnsi)(line)).toBe('BOLD RED done');
+    });
+});