agentflow-dashboard 0.8.2 → 0.8.4

package/dist/{chunk-EG254FLY.js → chunk-YLQ5MVCW.js}

@@ -1,16 +1,23 @@
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-
 // src/server.ts
-import { execSync } from "child_process";
+import { execFileSync, execSync } from "child_process";
 import * as fs3 from "fs";
 import { createServer } from "http";
 import * as path3 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
+import {
+  auditProcesses,
+  createExecutionEvent,
+  createKnowledgeStore,
+  discoverAllProcessConfigs,
+  discoverProcess,
+  findVariants,
+  getBottlenecks,
+  loadGraph as loadGraph2
+} from "agentflow-core";
+import chokidar2 from "chokidar";
+import express from "express";
+import rateLimit from "express-rate-limit";
+import { WebSocketServer } from "ws";
 
 // src/config.ts
 import { existsSync, readFileSync } from "fs";
@@ -83,21 +90,6 @@ function getProcessPreference(config) {
   return config.processPreference ?? null;
 }
 
-// src/server.ts
-import {
-  auditProcesses,
-  createExecutionEvent,
-  createKnowledgeStore,
-  discoverAllProcessConfigs,
-  discoverProcess,
-  findVariants,
-  getBottlenecks,
-  loadGraph as loadGraph2
-} from "agentflow-core";
-import chokidar2 from "chokidar";
-import express from "express";
-import { WebSocketServer } from "ws";
-
 // src/adapters/agentflow.ts
 var SKIP_FILES = /* @__PURE__ */ new Set([
   "workers.json",
@@ -109,7 +101,14 @@ var SKIP_FILES = /* @__PURE__ */ new Set([
   "models.json",
   "config.json"
 ]);
-var SKIP_SUFFIXES = ["-state.json", "-config.json", "-watch-state.json", ".tmp", ".bak", ".backup"];
+var SKIP_SUFFIXES = [
+  "-state.json",
+  "-config.json",
+  "-watch-state.json",
+  ".tmp",
+  ".bak",
+  ".backup"
+];
 var AgentFlowAdapter = class {
   name = "agentflow";
   detect(_dirPath) {
@@ -234,7 +233,7 @@ var OpenClawAdapter = class {
 };
 
 // src/adapters/otel.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync } from "fs";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3 } from "fs";
 import { join as join3 } from "path";
 var SPAN_TYPE_MAP = {
   "gen_ai.chat": "llm",
@@ -386,8 +385,14 @@ registerAdapter(new AgentFlowAdapter());
 var PURPOSE_KEYWORDS = [
   { keywords: ["email", "mail", "inbox", "smtp"], group: "Email Processors" },
   { keywords: ["monitor", "watch", "alert", "surveillance"], group: "Monitors" },
-  { keywords: ["digest", "newsletter", "summary", "report", "briefing"], group: "Digests & Reports" },
-  { keywords: ["curator", "janitor", "distiller", "surveyor", "worker", "indexer"], group: "Workers" },
+  {
+    keywords: ["digest", "newsletter", "summary", "report", "briefing"],
+    group: "Digests & Reports"
+  },
+  {
+    keywords: ["curator", "janitor", "distiller", "surveyor", "worker", "indexer"],
+    group: "Workers"
+  },
   { keywords: ["cron", "schedule", "timer", "periodic"], group: "Scheduled Jobs" },
   { keywords: ["search", "scrape", "crawl", "fetch"], group: "Data Collection" },
   { keywords: ["embed", "vector", "index"], group: "Embeddings" }
@@ -419,6 +424,7 @@ function capitalize(s) {
   return s.charAt(0).toUpperCase() + s.slice(1);
 }
 function deduplicateAgents(agents) {
+  var _a, _b, _c, _d;
   const tagged = agents.map((a) => ({
     ...a,
     ...extractSource(a.agentId)
@@ -435,14 +441,14 @@ function deduplicateAgents(agents) {
   const mergedIds = /* @__PURE__ */ new Set();
   const mergedAgents = [];
   for (const [_key, group] of suffixGroups) {
-    const suffix = extractSuffix(group[0].localId);
+    const suffix = extractSuffix((_a = group[0]) == null ? void 0 : _a.localId);
     if (group.length < 2) continue;
     const prefixes = new Set(group.map((a) => a.localId.split("-")[0]));
     if (prefixes.size < 2) continue;
     const longPrefixes = [...prefixes].filter((p) => p !== suffix && p.length > 2);
     if (longPrefixes.length >= 2) continue;
     const merged = {
-      agentId: group[0].source === "agentflow" ? suffix : `${group[0].source}:${suffix}`,
+      agentId: ((_b = group[0]) == null ? void 0 : _b.source) === "agentflow" ? suffix : `${(_c = group[0]) == null ? void 0 : _c.source}:${suffix}`,
       displayName: suffix,
       totalExecutions: group.reduce((s, a) => s + a.totalExecutions, 0),
       successfulExecutions: group.reduce((s, a) => s + a.successfulExecutions, 0),
@@ -453,7 +459,7 @@ function deduplicateAgents(agents) {
       triggers: {},
       recentActivity: group.flatMap((a) => a.recentActivity).sort((a, b) => b.timestamp - a.timestamp).slice(0, 50),
       sources: group.map((a) => a.agentId),
-      adapterSource: group[0].source
+      adapterSource: (_d = group[0]) == null ? void 0 : _d.source
     };
     merged.successRate = merged.totalExecutions > 0 ? merged.successfulExecutions / merged.totalExecutions * 100 : 0;
     const totalExecTime = group.reduce((s, a) => s + a.avgExecutionTime * a.totalExecutions, 0);
@@ -869,7 +875,9 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
       ...getSkipFiles(this.userConfig)
     ]);
     this.userSkipDirs = new Set(getSkipDirectories(this.userConfig));
-    this.allWatchDirs = [...new Set([this.tracesDir, ...this.dataDirs].map((d) => path.resolve(d)))];
+    this.allWatchDirs = [
+      ...new Set([this.tracesDir, ...this.dataDirs].map((d) => path.resolve(d)))
+    ];
     this.ensureTracesDir();
     this.loadExistingFiles();
     this.archiveOldTraces();
@@ -879,7 +887,7 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
   /** Move trace files older than maxAgeMs into archive/YYYY-MM/ subdirectories. */
   archiveOldTraces() {
     const cutoff = Date.now() - this.maxAgeMs;
-    let archived = 0;
+    const _archived = 0;
     for (const dir of this.allWatchDirs) {
       if (!fs.existsSync(dir)) continue;
       try {
@@ -896,7 +904,8 @@ var TraceWatcher = class _TraceWatcher extends EventEmitter {
     try {
       const entries = fs.readdirSync(dir, { withFileTypes: true });
       for (const entry of entries) {
-        if (entry.name.startsWith(".") || entry.name === "archive" || this.userSkipDirs.has(entry.name)) continue;
+        if (entry.name.startsWith(".") || entry.name === "archive" || this.userSkipDirs.has(entry.name))
+          continue;
         const fullPath = path.join(dir, entry.name);
         if (entry.isDirectory()) {
           archived += this.archiveDirectory(fullPath, cutoff, depth + 1);
@@ -2142,7 +2151,9 @@ import * as os from "os";
 import * as path2 from "path";
 import { fileURLToPath } from "url";
 var __cliDirname = path2.dirname(fileURLToPath(import.meta.url));
-var VERSION = JSON.parse(fs2.readFileSync(path2.resolve(__cliDirname, "../package.json"), "utf-8")).version;
+var VERSION = JSON.parse(
+  fs2.readFileSync(path2.resolve(__cliDirname, "../package.json"), "utf-8")
+).version;
 function getLanAddress() {
   const interfaces = os.networkInterfaces();
   for (const name of Object.keys(interfaces)) {
@@ -2399,6 +2410,17 @@ var DashboardServer = class {
   userConfig;
   configPath;
   setupExpress() {
+    this.app.use(
+      "/api/",
+      rateLimit({
+        windowMs: 60 * 1e3,
+        // 1 minute
+        max: 300,
+        // 300 requests per minute per IP
+        standardHeaders: true,
+        legacyHeaders: false
+      })
+    );
     if (this.config.enableCors) {
       this.app.use((_req, res, next) => {
         res.header("Access-Control-Allow-Origin", "*");
@@ -2425,10 +2447,6 @@ var DashboardServer = class {
     if (fs3.existsSync(clientDir)) {
       this.app.use(express.static(clientDir));
     }
-    const pkgVersion = JSON.parse(fs3.readFileSync(path3.resolve(__dirname, "../package.json"), "utf-8")).version;
-    this.app.get("/api/version", (_req, res) => {
-      res.json({ version: pkgVersion });
-    });
     this.app.get("/api/traces", (req, res) => {
       try {
         const limit = Math.min(Math.max(parseInt(req.query.limit, 10) || 50, 1), 200);
@@ -2645,6 +2663,7 @@ var DashboardServer = class {
       }
     });
     this.app.get("/api/process-model/:agentId", (req, res) => {
+      var _a, _b;
       try {
         const agentId = req.params.agentId;
         const allTraces = this.watcher.getTracesByAgent(agentId);
@@ -2662,8 +2681,8 @@ var DashboardServer = class {
           const nodeArr = Object.values(nodes);
           const sorted = nodeArr.filter((n) => n.name && typeof n.startTime === "number" && n.startTime > 0).sort((a, b) => (a.startTime ?? 0) - (b.startTime ?? 0));
           for (let i = 0; i < sorted.length - 1; i++) {
-            const from = sorted[i].name;
-            const to = sorted[i + 1].name;
+            const from = (_a = sorted[i]) == null ? void 0 : _a.name;
+            const to = (_b = sorted[i + 1]) == null ? void 0 : _b.name;
             const key = `${from}|||${to}`;
             transMap.set(key, (transMap.get(key) ?? 0) + 1);
           }
@@ -2762,7 +2781,11 @@ var DashboardServer = class {
       try {
         const reportPath = path3.join(somaVault, "..", "soma-report.json");
         if (!fs3.existsSync(reportPath)) {
-          return res.json({ available: false, teaser: false, message: "No report file yet. Run soma watch." });
+          return res.json({
+            available: false,
+            teaser: false,
+            message: "No report file yet. Run soma watch."
+          });
         }
         const report = JSON.parse(fs3.readFileSync(reportPath, "utf-8"));
         res.json(report);
@@ -2786,7 +2809,9 @@ var DashboardServer = class {
           available: true,
           layers: report.layers ?? { archive: 0, working: 0, emerging: 0, canon: 0 },
           governance: report.governance ?? { pending: 0, promoted: 0, rejected: 0 },
-          insights: (report.insights ?? []).filter((i) => i.layer === "emerging" && i.proposal_status === "pending"),
+          insights: (report.insights ?? []).filter(
+            (i) => i.layer === "emerging" && i.proposal_status === "pending"
+          ),
           canon: (report.insights ?? []).filter((i) => i.layer === "canon"),
           generatedAt: report.generatedAt
         });
@@ -2795,21 +2820,23 @@ var DashboardServer = class {
         res.status(500).json({ available: false, message: "Failed to read governance data" });
       }
     });
-    const sanitizeArg = (s) => s.replace(/[^a-zA-Z0-9_\-.:]/g, "");
-    const sanitizeReason = (s) => s.replace(/["`$\\]/g, "").slice(0, 500);
+    const isValidId = (s) => /^[a-zA-Z0-9_\-.:]+$/.test(s);
     this.app.post("/api/soma/governance/promote", (req, res) => {
       var _a;
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.status(400).json({ error: "Soma vault not configured" });
       const { entryId } = req.body ?? {};
-      if (!entryId) return res.status(400).json({ error: "entryId required" });
+      if (!entryId || !isValidId(String(entryId)))
+        return res.status(400).json({ error: "Invalid entryId" });
       try {
-        const { execSync: execSync2 } = __require("child_process");
-        const safeId = sanitizeArg(String(entryId));
-        const result = execSync2(`npx soma governance promote ${safeId} --vault "${somaVault}"`, {
-          encoding: "utf-8",
-          timeout: 1e4
-        });
+        const result = execFileSync(
+          "npx",
+          ["soma", "governance", "promote", String(entryId), "--vault", somaVault],
+          {
+            encoding: "utf-8",
+            timeout: 1e4
+          }
+        );
         res.json({ success: true, message: result.trim() });
       } catch (error) {
         res.status(400).json({ error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message });
@@ -2820,15 +2847,27 @@ var DashboardServer = class {
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.status(400).json({ error: "Soma vault not configured" });
       const { entryId, reason } = req.body ?? {};
-      if (!entryId || !reason) return res.status(400).json({ error: "entryId and reason required" });
+      if (!entryId || !isValidId(String(entryId)))
+        return res.status(400).json({ error: "Invalid entryId" });
+      if (!reason || typeof reason !== "string")
+        return res.status(400).json({ error: "reason required" });
       try {
-        const { execSync: execSync2 } = __require("child_process");
-        const safeId = sanitizeArg(String(entryId));
-        const safeReason = sanitizeReason(String(reason));
-        const result = execSync2(`npx soma governance reject ${safeId} "${safeReason}" --vault "${somaVault}"`, {
-          encoding: "utf-8",
-          timeout: 1e4
-        });
+        const result = execFileSync(
+          "npx",
+          [
+            "soma",
+            "governance",
+            "reject",
+            String(entryId),
+            String(reason).slice(0, 500),
+            "--vault",
+            somaVault
+          ],
+          {
+            encoding: "utf-8",
+            timeout: 1e4
+          }
+        );
         res.json({ success: true, message: result.trim() });
       } catch (error) {
         res.status(400).json({ error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message });
@@ -2838,13 +2877,16 @@ var DashboardServer = class {
       var _a;
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.status(400).json({ error: "Soma vault not configured" });
+      if (!isValidId(String(req.params.id))) return res.status(400).json({ error: "Invalid id" });
       try {
-        const { execSync: execSync2 } = __require("child_process");
-        const safeId = sanitizeArg(String(req.params.id));
-        const result = execSync2(`npx soma governance show ${safeId} --vault "${somaVault}"`, {
-          encoding: "utf-8",
-          timeout: 1e4
-        });
+        const result = execFileSync(
+          "npx",
+          ["soma", "governance", "show", String(req.params.id), "--vault", somaVault],
+          {
+            encoding: "utf-8",
+            timeout: 1e4
+          }
+        );
         res.json({ available: true, output: result.trim() });
       } catch (error) {
         res.status(404).json({ error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message });
@@ -2867,16 +2909,24 @@ var DashboardServer = class {
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.status(400).json({ error: "Soma vault not configured" });
       const { name, enforcement, scope, conditions } = req.body ?? {};
-      if (!name) return res.status(400).json({ error: "name required" });
+      if (!name || !isValidId(String(name)))
+        return res.status(400).json({ error: "Invalid policy name" });
+      const enf = String(enforcement || "warn");
+      if (!isValidId(enf)) return res.status(400).json({ error: "Invalid enforcement value" });
       try {
-        const safeName = sanitizeArg(String(name));
-        const safeEnf = sanitizeArg(String(enforcement || "warn"));
-        const safeScope = sanitizeReason(String(scope || "all"));
-        const safeCond = sanitizeReason(String(conditions || ""));
-        const result = execSync(
-          `npx soma policy create "${safeName}" --enforcement ${safeEnf} --scope "${safeScope}" --conditions "${safeCond}" --vault "${somaVault}"`,
-          { encoding: "utf-8", timeout: 1e4 }
-        );
+        const args = [
+          "soma",
+          "policy",
+          "create",
+          String(name),
+          "--enforcement",
+          enf,
+          "--vault",
+          somaVault
+        ];
+        if (scope) args.push("--scope", String(scope).slice(0, 500));
+        if (conditions) args.push("--conditions", String(conditions).slice(0, 500));
+        const result = execFileSync("npx", args, { encoding: "utf-8", timeout: 1e4 });
         res.json({ success: true, message: result.trim() });
       } catch (error) {
         res.status(400).json({ error: ((_a = error.stderr) == null ? void 0 : _a.trim()) || error.message });
@@ -2886,11 +2936,16 @@ var DashboardServer = class {
       var _a;
       const somaVault = this.config.somaVault;
       if (!somaVault) return res.status(400).json({ error: "Soma vault not configured" });
+      if (!isValidId(String(req.params.name)))
+        return res.status(400).json({ error: "Invalid policy name" });
       try {
-        const safeName = sanitizeArg(String(req.params.name));
-        const result = execSync(
-          `npx soma policy delete "${safeName}" --vault "${somaVault}"`,
-          { encoding: "utf-8", timeout: 1e4 }
+        const result = execFileSync(
+          "npx",
+          ["soma", "policy", "delete", String(req.params.name), "--vault", somaVault],
+          {
+            encoding: "utf-8",
+            timeout: 1e4
+          }
         );
         res.json({ success: true, message: result.trim() });
       } catch (error) {
@@ -2908,16 +2963,28 @@ var DashboardServer = class {
           ...(report.agents ?? []).map((a) => ({ ...a, type: "agent", id: a.name })),
           ...(report.insights ?? []).map((i, idx) => {
             var _a;
-            return { ...i, type: i.type || "insight", id: ((_a = i.title) == null ? void 0 : _a.replace(/\s+/g, "-").toLowerCase()) || `insight-${idx}` };
+            return {
+              ...i,
+              type: i.type || "insight",
+              id: ((_a = i.title) == null ? void 0 : _a.replace(/\s+/g, "-").toLowerCase()) || `insight-${idx}`
+            };
           }),
           ...(report.policies ?? []).map((p) => ({ ...p, type: "policy", id: p.name }))
         ];
-        const { type, layer, q, limit: limitStr, offset: offsetStr } = req.query;
+        const {
+          type,
+          layer,
+          q,
+          limit: limitStr,
+          offset: offsetStr
+        } = req.query;
         if (type) entities = entities.filter((e) => e.type === type);
         if (layer) entities = entities.filter((e) => e.layer === layer);
         if (q) {
           const lq = q.toLowerCase();
-          entities = entities.filter((e) => (e.name || e.title || "").toLowerCase().includes(lq) || (e.claim || e.body || "").toLowerCase().includes(lq));
+          entities = entities.filter(
+            (e) => (e.name || e.title || "").toLowerCase().includes(lq) || (e.claim || e.body || "").toLowerCase().includes(lq)
+          );
         }
         const total = entities.length;
         const offset = parseInt(offsetStr || "0", 10);
@@ -3008,9 +3075,7 @@ var DashboardServer = class {
         const orphans = uniqueProcesses.filter(
           (p) => !allKnownPids.has(p.pid) && p.pid !== process.pid && p.pid !== process.ppid
         );
-        const problems = services.flatMap(
-          (s) => s.audit.problems.map((p) => `[${s.name}] ${p}`)
-        );
+        const problems = services.flatMap((s) => s.audit.problems.map((p) => `[${s.name}] ${p}`));
         const result = {
           // Backward-compatible fields from primary service
           pidFile: (primary == null ? void 0 : primary.audit.pidFile) ?? null,
@@ -3065,19 +3130,24 @@ var DashboardServer = class {
           }
         } catch {
         }
-        const watched = [...new Set([
-          this.config.tracesDir,
-          ...this.config.dataDirs || [],
-          ...extraDirs
-        ].map((w) => path3.resolve(w)))];
+        const watched = [
+          ...new Set(
+            [this.config.tracesDir, ...this.config.dataDirs || [], ...extraDirs].map(
+              (w) => path3.resolve(w)
+            )
+          )
+        ];
         const discovered = [];
         const svcNames = getSystemdServices(this.userConfig);
         if (svcNames.length > 0) {
           try {
-            const { execSync: execSync2 } = __require("child_process");
-            const raw = execSync2(
-              `systemctl --user show --property=ExecStart --no-pager ${svcNames.join(" ")} 2>/dev/null`,
-              { encoding: "utf8", timeout: 5e3 }
+            const raw = execFileSync(
+              "systemctl",
+              ["--user", "show", "--property=ExecStart", "--no-pager", ...svcNames],
+              {
+                encoding: "utf8",
+                timeout: 5e3
+              }
             );
             for (const line of raw.split("\n")) {
               const match = line.match(/path=([^\s;]+)/);
@@ -3109,10 +3179,19 @@ var DashboardServer = class {
     this.app.post("/api/directories", express.json(), (req, res) => {
       try {
         const { add, remove } = req.body;
-        if (add && !fs3.existsSync(add)) {
-          return res.status(400).json({ error: `Directory does not exist: ${add}` });
+        if (add) {
+          const resolved = path3.resolve(add);
+          if (resolved !== add || add.includes("..")) {
+            return res.status(400).json({ error: "Invalid directory path" });
+          }
+          if (!fs3.existsSync(resolved)) {
+            return res.status(400).json({ error: `Directory does not exist: ${add}` });
+          }
         }
-        const configPath = path3.join(process.env.HOME ?? "/home/trader", ".agentflow/dashboard-config.json");
+        const configPath = path3.join(
+          process.env.HOME ?? "/home/trader",
+          ".agentflow/dashboard-config.json"
+        );
         let config = {};
         try {
           if (fs3.existsSync(configPath)) {
@@ -3322,13 +3401,31 @@ var DashboardServer = class {
         isVirtual: false
       });
     }
-    const rootSteps = new Set(model.steps);
-    const childSteps = new Set(model.transitions.map((t) => t.to));
-    const leafSteps = new Set(model.steps);
-    for (const t of model.transitions) {
-    }
-    nodes.push({ id: "[START]", label: "[START]", count: model.totalGraphs, frequency: 1, avgDuration: 0, failRate: 0, p95Duration: 0, isVirtual: true });
-    nodes.push({ id: "[END]", label: "[END]", count: model.totalGraphs, frequency: 1, avgDuration: 0, failRate: 0, p95Duration: 0, isVirtual: true });
+    const _rootSteps = new Set(model.steps);
+    const _childSteps = new Set(model.transitions.map((t) => t.to));
+    const _leafSteps = new Set(model.steps);
+    for (const _t of model.transitions) {
+    }
+    nodes.push({
+      id: "[START]",
+      label: "[START]",
+      count: model.totalGraphs,
+      frequency: 1,
+      avgDuration: 0,
+      failRate: 0,
+      p95Duration: 0,
+      isVirtual: true
+    });
+    nodes.push({
+      id: "[END]",
+      label: "[END]",
+      count: model.totalGraphs,
+      frequency: 1,
+      avgDuration: 0,
+      failRate: 0,
+      p95Duration: 0,
+      isVirtual: true
+    });
     const edges = model.transitions.map((t) => ({
       source: t.from,
       target: t.to,
@@ -3348,7 +3445,10 @@ var DashboardServer = class {
       }
     }
     const maxEdgeCount = Math.max(...edges.map((e) => e.count), 1);
-    const maxNodeCount = Math.max(...nodes.filter((n) => !n.isVirtual).map((n) => n.count), 1);
+    const maxNodeCount = Math.max(
+      ...nodes.filter((n) => !n.isVirtual).map((n) => n.count),
+      1
+    );
     return { agentId, totalTraces: model.totalGraphs, nodes, edges, maxEdgeCount, maxNodeCount };
   }
   /**