dsh-harbor-evolution 0.3.1 → 0.5.0

package/lib/dashboard.js

@@ -0,0 +1,266 @@
+import { access, constants, lstat, readdir, readFile, stat } from 'node:fs/promises'
+import path from 'node:path'
+
+import { resolveWithin } from './evolution.js'
+
+const SUMMARY_NAME = 'evaluation-summary.json'
+const MAX_JOBS = 50
+const MAX_JSON_BYTES = 2 * 1024 * 1024
+const MAX_TRIAL_LIMIT = 100
+const jsonCache = new Map()
+const SENSITIVE_KEY = /authorization|cookie|token|api[_-]?key|secret|password|request[_-]?headers/i
+
+function safeSegment(value, label) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(String(value ?? ''))) throw new Error(`${label} is invalid`)
+  return String(value)
+}
+
+function redact(value, depth = 0) {
+  if (depth > 10) return '[TRUNCATED depth]'
+  if (Array.isArray(value)) return value.slice(0, 10_000).map(item => redact(item, depth + 1))
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, SENSITIVE_KEY.test(key) ? '[REDACTED]' : redact(item, depth + 1)]))
+  }
+  if (typeof value === 'string' && value.length > 8_000) return `${value.slice(0, 8_000)}\n[TRUNCATED ${value.length - 8_000} chars]`
+  return value
+}
+
+async function readJson(file, { maxBytes = MAX_JSON_BYTES } = {}) {
+  try {
+    const details = await lstat(file)
+    if (details.isSymbolicLink()) return { __readError: `${path.basename(file)} may not be a symlink` }
+    if (!details.isFile()) return { __readError: `${path.basename(file)} is not a file` }
+    if (details.size > maxBytes) return { __readError: `${path.basename(file)} exceeds ${maxBytes} bytes` }
+    const cached = jsonCache.get(file)
+    const identity = `${details.mtimeMs}:${details.size}`
+    if (cached?.identity === identity) return cached.value
+    const value = redact(JSON.parse(await readFile(file, 'utf8')))
+    jsonCache.set(file, { identity, value })
+    return value
+  } catch (error) {
+    if (error.code === 'ENOENT') return undefined
+    if (error instanceof SyntaxError) return { __readError: `invalid JSON in ${path.basename(file)}` }
+    throw error
+  }
+}
+
+async function directoryCheck(directory, { optional = false } = {}) {
+  try {
+    const details = await lstat(directory)
+    if (details.isSymbolicLink() || !details.isDirectory()) return { status: 'error', detail: 'not a safe directory' }
+    await access(directory, constants.R_OK)
+    return { status: 'ok', detail: 'readable' }
+  } catch (error) {
+    if (optional && error.code === 'ENOENT') return { status: 'warning', detail: 'not created yet' }
+    return { status: 'error', detail: error.code === 'ENOENT' ? 'not found' : 'not readable' }
+  }
+}
+
+async function fileCheck(file) {
+  try {
+    const details = await lstat(file)
+    return details.isFile() && !details.isSymbolicLink()
+      ? { status: 'ok', detail: path.basename(file) }
+      : { status: 'error', detail: 'not a safe file' }
+  } catch (error) {
+    return { status: 'error', detail: error.code === 'ENOENT' ? 'not found' : 'not readable' }
+  }
+}
+
+async function executableCheck(command) {
+  if (!command) return { status: 'error', detail: 'not configured' }
+  if (!path.isAbsolute(command)) return { status: 'ok', detail: `${command} (PATH)` }
+  try {
+    await access(command, constants.X_OK)
+    return { status: 'ok', detail: path.basename(command) }
+  } catch (error) {
+    return { status: 'error', detail: error.code === 'ENOENT' ? 'not found' : 'not executable' }
+  }
+}
+
+function jobStatus(summary) {
+  if (!summary) return 'pending'
+  if (summary.__readError) return 'failed'
+  if (Number(summary.n_trials ?? 0) > 0 && Number(summary.n_exceptions ?? 0) >= Number(summary.n_trials ?? 0)) return 'failed'
+  if (Number(summary.n_exceptions ?? 0) > 0) return 'partial'
+  return 'completed'
+}
+
+function primaryMetric(summary, contract) {
+  const name = contract?.primary_metric
+  if (name && typeof summary?.metrics?.[name] === 'number') return { name, value: summary.metrics[name] }
+  const entry = Object.entries(summary?.metrics ?? {}).find(([, value]) => typeof value === 'number')
+  return entry ? { name: entry[0], value: entry[1] } : undefined
+}
+
+async function readJob(jobsDir, entry, details) {
+  const directory = path.join(jobsDir, entry.name)
+  const [summary, context, promotion, contract] = await Promise.all([
+    readJson(path.join(directory, SUMMARY_NAME)),
+    readJson(path.join(directory, 'evaluation-context.json')),
+    readJson(path.join(directory, 'promotion-report.json')),
+    readJson(path.join(directory, 'evaluation-contract.json')),
+  ])
+  const evaluationContext = summary?.evaluation_context ?? context
+  if (evaluationContext?.schema_version !== 2) return undefined
+  return {
+    name: entry.name,
+    updatedAt: details.mtime.toISOString(),
+    status: jobStatus(summary),
+    mode: summary?.mode,
+    nTrials: Number(summary?.n_trials ?? 0),
+    nExceptions: Number(summary?.n_exceptions ?? 0),
+    primaryMetric: primaryMetric(summary, contract),
+    metrics: summary?.metrics ?? {},
+    candidate: summary?.candidate,
+    evaluationContext,
+    artifactValidation: summary?.artifact_validation,
+    promotion: promotion ? { decision: promotion.decision, reasons: promotion.reasons ?? [], baselineJob: promotion.baseline_job } : undefined,
+    readError: summary?.__readError,
+  }
+}
+
+async function listJobs(jobsDir) {
+  let entries
+  try {
+    entries = await readdir(jobsDir, { withFileTypes: true })
+  } catch (error) {
+    if (error.code === 'ENOENT') return []
+    throw error
+  }
+  const directories = entries.filter(entry => entry.isDirectory() && !entry.isSymbolicLink())
+  const recent = await Promise.all(directories.map(async entry => ({ entry, details: await stat(path.join(jobsDir, entry.name)) })))
+  recent.sort((left, right) => right.details.mtimeMs - left.details.mtimeMs)
+  const jobs = await Promise.all(recent.map(({ entry, details }) => readJob(jobsDir, entry, details)))
+  return jobs.filter(Boolean).slice(0, MAX_JOBS)
+}
+
+function jobsDirectory(config) {
+  return resolveWithin(path.resolve(config.projectRoot), config.jobsDir, 'jobsDir')
+}
+
+function jobDirectory(config, job) {
+  return path.join(jobsDirectory(config), safeSegment(job, 'job'))
+}
+
+export async function readDashboardSnapshot(config, metadata = {}) {
+  const projectRoot = path.resolve(config.projectRoot)
+  const jobsDir = jobsDirectory(config)
+  const [jobs, projectRootCheck, jobsDirCheck, harborCheck, harborDshCheck, stackCheck] = await Promise.all([
+    listJobs(jobsDir),
+    directoryCheck(projectRoot),
+    directoryCheck(jobsDir, { optional: true }),
+    executableCheck(config.harborBin),
+    executableCheck(config.harborDshBin),
+    fileCheck(path.join(projectRoot, '.harbor', 'evaluation-stack.yml')),
+  ])
+  const counts = jobs.reduce((result, job) => ({ ...result, [job.status]: (result[job.status] ?? 0) + 1 }), {})
+  const latestMetric = jobs.find(job => job.primaryMetric)?.primaryMetric
+  return {
+    schemaVersion: 2,
+    generatedAt: new Date().toISOString(),
+    pluginVersion: metadata.pluginVersion ?? 'development',
+    config: { jobsDir: config.jobsDir, dshVersion: config.dshVersion, agentImportPath: config.agentImportPath, pluginImportPath: config.pluginImportPath },
+    checks: { projectRoot: projectRootCheck, jobsDir: jobsDirCheck, harbor: harborCheck, harborDsh: harborDshCheck, evaluationStack: stackCheck },
+    overview: {
+      totalJobs: jobs.length,
+      completedJobs: (counts.completed ?? 0) + (counts.partial ?? 0),
+      activeJobs: counts.pending ?? 0,
+      failedJobs: counts.failed ?? 0,
+      latestMetric,
+    },
+    jobs,
+  }
+}
+
+const DETAIL_ARTIFACTS = {
+  summary: 'evaluation-summary.json',
+  candidate: 'candidate-manifest.json',
+  dataset: 'dataset-manifest.json',
+  stack: 'evaluation-stack-manifest.json',
+  context: 'evaluation-context.json',
+  contract: 'evaluation-contract.json',
+  doctor: 'architecture-doctor.json',
+  population: 'population-report.json',
+  optimization: 'optimization-report.json',
+  promotion: 'promotion-report.json',
+}
+
+function schemaIssue(key, value) {
+  if (value === undefined) return undefined
+  if (value?.__readError) return value.__readError
+  if (!isObject(value)) return 'artifact must be an object'
+  const version = { summary: 2, candidate: 1, dataset: 1, stack: 1, context: 2, contract: 1, doctor: 1, population: 1, optimization: 1, promotion: 2 }[key]
+  if (value.schema_version !== version) return `schema_version must be ${version}`
+  const required = {
+    summary: ['job', 'candidate', 'evaluation_context', 'metrics'],
+    candidate: ['candidate_id', 'version', 'digest'],
+    dataset: ['dataset_id', 'version', 'source_digest', 'tasks'],
+    stack: ['stack_id', 'version', 'digest', 'comparison_digest', 'components', 'judge'],
+    context: ['digest', 'full_digest', 'candidate', 'dataset', 'evaluation_stack', 'runtime'],
+    contract: ['contract_id', 'version', 'primary_metric', 'metrics'],
+    doctor: ['promotion_ready', 'findings'],
+    population: ['population_size', 'groups', 'metrics'],
+    optimization: ['hypotheses'],
+    promotion: ['decision', 'reasons', 'policy_digest'],
+  }[key] ?? []
+  const missing = required.filter(field => value[field] === undefined)
+  return missing.length ? `missing fields: ${missing.join(', ')}` : undefined
+}
+
+function isObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+export async function readJobDetail(config, args) {
+  const job = safeSegment(args.job, 'job')
+  const directory = jobDirectory(config, job)
+  const check = await directoryCheck(directory)
+  if (check.status !== 'ok') throw new Error('Job not found')
+  const values = await Promise.all(Object.values(DETAIL_ARTIFACTS).map(name => readJson(path.join(directory, name))))
+  const artifacts = Object.fromEntries(Object.keys(DETAIL_ARTIFACTS).map((key, index) => [key, values[index]]))
+  if (artifacts.summary && !artifacts.summary.__readError) {
+    const { trials: _trials, ...lightSummary } = artifacts.summary
+    artifacts.summary = lightSummary
+  }
+  const validation = Object.fromEntries(Object.entries(artifacts).map(([key, value]) => {
+    const issue = schemaIssue(key, value)
+    return [key, value === undefined ? { status: 'missing' } : issue ? { status: 'invalid', error: issue } : { status: 'valid' }]
+  }))
+  if (validation.context.status !== 'valid') throw new Error('Job is not a Context v2 evaluation')
+  return { schemaVersion: 1, job, artifacts, validation }
+}
+
+export async function readTrialsPage(config, args) {
+  const job = safeSegment(args.job, 'job')
+  const offset = Math.max(0, Number.parseInt(args.offset ?? 0, 10) || 0)
+  const limit = Math.min(MAX_TRIAL_LIMIT, Math.max(1, Number.parseInt(args.limit ?? 50, 10) || 50))
+  const query = String(args.query ?? '').trim().toLowerCase()
+  const status = String(args.status ?? '')
+  const summary = await readJson(path.join(jobDirectory(config, job), SUMMARY_NAME))
+  if (!summary || summary.__readError) throw new Error('Job summary is unavailable')
+  let trials = Array.isArray(summary.trials) ? summary.trials : []
+  if (query) trials = trials.filter(trial => `${trial.id ?? ''} ${trial.name ?? ''}`.toLowerCase().includes(query))
+  if (status) trials = trials.filter(trial => (trial.exception ? 'infrastructure-error' : 'assessed') === status)
+  const items = trials.slice(offset, offset + limit).map(trial => ({
+    id: trial.id ?? trial.name,
+    name: trial.name,
+    status: trial.exception ? 'infrastructure-error' : 'assessed',
+    rewards: trial.rewards ?? {},
+    exception: trial.exception ? { type: trial.exception.type, classification: trial.exception.classification } : undefined,
+  }))
+  return { schemaVersion: 1, job, offset, limit, total: trials.length, items, hasMore: offset + items.length < trials.length }
+}
+
+function assessmentName(id) {
+  return `${String(id).replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^[.-]+|[.-]+$/g, '') || 'trial'}.json`
+}
+
+export async function readTrialDetail(config, args) {
+  const job = safeSegment(args.job, 'job')
+  const trial = safeSegment(args.trial, 'trial')
+  const directory = jobDirectory(config, job)
+  const assessment = await readJson(path.join(directory, 'trial-assessments', assessmentName(trial)))
+  if (!assessment || assessment.__readError) throw new Error('Trial assessment not found')
+  return { schemaVersion: 1, job, trial, assessment }
+}

package/lib/evolution.js

@@ -23,47 +23,135 @@ export async function snapshot(config, args) {
 }
 
 function slug(value) {
-  return String(value)
-    .toLowerCase()
-    .replace(/[^a-z0-9._-]+/g, '-')
-    .replace(/^[._-]+|[._-]+$/g, '') || 'candidate'
+  return String(value).toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^[._-]+|[._-]+$/g, '') || 'candidate'
 }
 
 export function makeJobName(manifest, now = new Date()) {
   const timestamp = now.toISOString().replace(/\.\d{3}Z$/, 'Z').replace(/[-:]/g, '')
   const suffix = `${timestamp}-${manifest.digest.slice(7, 15)}`
-  const available = 100 - suffix.length - 1
-  const identity = `${slug(manifest.candidate_id)}-${slug(manifest.version)}`.slice(0, available)
+  const identity = `${slug(manifest.candidate_id)}-${slug(manifest.version)}`.slice(0, 99 - suffix.length)
   return `${identity}-${suffix}`
 }
 
+async function cliJson(config, args, { allowedExitCodes = [0] } = {}) {
+  const result = await runProcess(config.harborDshBin, args, {
+    cwd: config.projectRoot,
+    timeoutMs: config.timeoutMs,
+    allowedExitCodes,
+    env: { ...process.env, ...(config.pythonPath ? { PYTHONPATH: config.pythonPath } : {}) },
+  })
+  try {
+    return JSON.parse(result.stdout)
+  } catch {
+    throw new Error(`harbor-dsh returned invalid JSON for ${args.slice(0, 2).join(' ')}`)
+  }
+}
+
+function strictInputs(config, args) {
+  const projectRoot = path.resolve(config.projectRoot)
+  const candidate = resolveWithin(projectRoot, args.candidatePath, 'candidatePath')
+  const dataset = resolveWithin(projectRoot, args.datasetPath, 'datasetPath')
+  const stack = resolveWithin(projectRoot, args.stackPath, 'stackPath')
+  const jobs = resolveWithin(projectRoot, config.jobsDir, 'jobsDir')
+  const mode = args.mode
+  if (!['diagnostic', 'promotion-eligible'].includes(mode)) throw new Error('mode must be diagnostic or promotion-eligible')
+  const policy = args.policyPath ? resolveWithin(projectRoot, args.policyPath, 'policyPath') : undefined
+  if (mode === 'promotion-eligible' && !policy) throw new Error('promotion-eligible mode requires policyPath')
+  return { projectRoot, candidate, dataset, stack, jobs, mode, policy }
+}
+
+export async function validateDataset(config, args) {
+  const dataset = resolveWithin(config.projectRoot, args.datasetPath, 'datasetPath')
+  return cliJson(config, ['dataset', 'validate', dataset, '--project-root', config.projectRoot], { allowedExitCodes: [0, 2] })
+}
+
+export async function initializeProject(config, args) {
+  const dataset = resolveWithin(config.projectRoot, args.datasetPath, 'datasetPath')
+  return cliJson(config, [
+    'init', '--project-root', config.projectRoot, '--dataset', dataset,
+    '--stack-id', args.stackId, '--stack-version', args.stackVersion,
+    '--dataset-id', args.datasetId, '--dataset-version', args.datasetVersion,
+    '--contract-id', args.contractId, '--contract-version', args.contractVersion,
+    '--primary-metric', args.primaryMetric, '--primary-direction', args.primaryDirection,
+    '--judge-provider', args.judgeProvider, '--judge-model', args.judgeModel, '--judge-version', args.judgeVersion,
+    '--policy-id', args.policyId, '--policy-version', args.policyVersion,
+    '--min-improvement', String(args.minImprovement),
+  ])
+}
+
+export async function runDoctor(config, args) {
+  const inputs = strictInputs(config, { ...args, mode: args.mode ?? 'diagnostic' })
+  const command = ['doctor', '--architecture', '--project-root', inputs.projectRoot, '--stack', inputs.stack, '--dataset', inputs.dataset]
+  if (args.candidatePath) command.push('--candidate', inputs.candidate)
+  if (inputs.policy) command.push('--policy', inputs.policy)
+  return cliJson(config, command, { allowedExitCodes: [0, 2] })
+}
+
+export async function previewContext(config, args) {
+  const manifest = await snapshot(config, args)
+  const inputs = strictInputs(config, args)
+  const preview = await cliJson(config, [
+    'context', 'preview',
+    '--project-root', inputs.projectRoot,
+    '--candidate', inputs.candidate,
+    '--dataset', inputs.dataset,
+    '--stack', inputs.stack,
+    '--jobs-dir', inputs.jobs,
+    '--mode', inputs.mode,
+  ])
+  return { manifest, ...preview }
+}
+
 export async function runEvaluation(config, args) {
   const manifest = await snapshot(config, args)
-  const candidateDir = resolveWithin(config.projectRoot, args.candidatePath, 'candidatePath')
-  const dataset = resolveWithin(config.projectRoot, args.datasetPath, 'datasetPath')
-  const jobsDir = resolveWithin(config.projectRoot, config.jobsDir, 'jobsDir')
+  const inputs = strictInputs(config, args)
+  const datasetValidation = await validateDataset(config, args)
+  if (!datasetValidation.valid) {
+    throw new Error(`Dataset validation failed: ${datasetValidation.findings.map(item => item.code).join(', ')}`)
+  }
+  const doctor = await runDoctor(config, args)
+  if (inputs.mode === 'promotion-eligible' && !doctor.promotion_ready) {
+    throw new Error(`Architecture Doctor blocked promotion-eligible Job: ${doctor.findings.filter(item => item.level === 'error').map(item => item.code).join(', ')}`)
+  }
+  const preview = await cliJson(config, [
+    'context', 'preview', '--project-root', inputs.projectRoot,
+    '--candidate', inputs.candidate, '--dataset', inputs.dataset,
+    '--stack', inputs.stack, '--jobs-dir', inputs.jobs, '--mode', inputs.mode,
+  ])
   const jobName = args.jobName ?? makeJobName(manifest)
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(jobName)) throw new Error('jobName contains unsupported characters')
 
   const harborArgs = [
-    'run', '-p', dataset,
+    'run', '-p', inputs.dataset,
     '-a', config.agentImportPath,
-    '--ak', `candidate_path=${candidateDir}`,
+    '--ak', `candidate_path=${inputs.candidate}`,
     '--ak', `candidate_version=${manifest.version}`,
     '--ak', `candidate_digest=${manifest.digest}`,
     '--job-name', jobName,
-    '--jobs-dir', jobsDir,
+    '--jobs-dir', inputs.jobs,
     '--plugin', config.pluginImportPath,
-    '--plugin-kwarg', `candidate_manifest=${path.join(candidateDir, MANIFEST_NAME)}`,
+    '--plugin-kwarg', `candidate_manifest=${path.join(inputs.candidate, MANIFEST_NAME)}`,
+    '--plugin-kwarg', `dataset_path=${inputs.dataset}`,
+    '--plugin-kwarg', `stack_path=${inputs.stack}`,
+    '--plugin-kwarg', `project_root=${inputs.projectRoot}`,
+    '--plugin-kwarg', `mode=${inputs.mode}`,
   ]
-  const result = await runProcess(config.harborBin, harborArgs, {
+  if (inputs.policy) harborArgs.push('--plugin-kwarg', `policy_path=${inputs.policy}`)
+  const processResult = await runProcess(config.harborBin, harborArgs, {
     cwd: config.projectRoot,
     timeoutMs: config.timeoutMs,
     env: { ...process.env, ...(config.pythonPath ? { PYTHONPATH: config.pythonPath } : {}) },
   })
-  const jobDir = path.join(jobsDir, jobName)
+  const jobDir = path.join(inputs.jobs, jobName)
   const summary = JSON.parse(await readFile(path.join(jobDir, 'evaluation-summary.json'), 'utf8'))
-  return { manifest, jobDir, summary, process: { code: result.code } }
+  return {
+    manifest,
+    job: path.relative(inputs.projectRoot, jobDir),
+    summary,
+    doctor,
+    contextPreview: preview,
+    process: { code: processResult.code },
+  }
 }
 
 export async function readEvaluation(config, args) {
@@ -75,14 +163,5 @@ export async function compareCandidates(config, args) {
   const baseline = resolveWithin(config.projectRoot, args.baselineJob, 'baselineJob')
   const candidate = resolveWithin(config.projectRoot, args.candidateJob, 'candidateJob')
   const policy = resolveWithin(config.projectRoot, args.policyPath, 'policyPath')
-  const result = await runProcess(config.harborDshBin, [
-    'promote', baseline, candidate, '--policy', policy,
-  ], {
-    cwd: config.projectRoot,
-    timeoutMs: config.timeoutMs,
-    // harbor-dsh uses exit 1 for a valid REJECT decision. The report remains
-    // model-readable; infrastructure failures still reject the subprocess.
-    allowedExitCodes: [0, 1],
-  })
-  return JSON.parse(result.stdout)
+  return cliJson(config, ['promote', baseline, candidate, '--policy', policy], { allowedExitCodes: [0, 1] })
 }

package/lib/service.js

@@ -0,0 +1,67 @@
+import { readDashboardSnapshot, readJobDetail, readTrialDetail, readTrialsPage } from './dashboard.js'
+import {
+  compareCandidates,
+  initializeProject,
+  previewContext,
+  readEvaluation,
+  runDoctor,
+  runEvaluation,
+  snapshot,
+  validateDataset,
+} from './evolution.js'
+
+/** One Host-side boundary shared by Agent tools and the Web dashboard. */
+export class EvolutionService {
+  constructor(config, metadata = {}) {
+    this.config = config
+    this.metadata = metadata
+  }
+
+  snapshot(args) {
+    return snapshot(this.config, args)
+  }
+
+  initialize(args) {
+    return initializeProject(this.config, args)
+  }
+
+  run(args) {
+    return runEvaluation(this.config, args)
+  }
+
+  result(args) {
+    return readEvaluation(this.config, args)
+  }
+
+  compare(args) {
+    return compareCandidates(this.config, args)
+  }
+
+  doctor(args) {
+    return runDoctor(this.config, args)
+  }
+
+  validateDataset(args) {
+    return validateDataset(this.config, args)
+  }
+
+  previewContext(args) {
+    return previewContext(this.config, args)
+  }
+
+  dashboard() {
+    return readDashboardSnapshot(this.config, this.metadata)
+  }
+
+  job(args) {
+    return readJobDetail(this.config, args)
+  }
+
+  trials(args) {
+    return readTrialsPage(this.config, args)
+  }
+
+  trial(args) {
+    return readTrialDetail(this.config, args)
+  }
+}

package/lib/setup.js

@@ -247,6 +247,10 @@ export async function setupIntegration(raw = {}, dependencies = {}) {
     // the complete locked graph there so runtime dependencies and host peers
     // do not disappear behind the profile's `link:` entry.
     await run('npm', ['ci', '--ignore-scripts'], { cwd: localPluginDir })
+    // The browser half is generated from source and embeds its visual asset.
+    // Build explicitly because the locked install above intentionally skips
+    // lifecycle scripts for deterministic source-checkout setup.
+    await run('npm', ['run', 'build'], { cwd: localPluginDir })
   }
 
   progress('2/4 Installing the Harbor Python runtime...')
@@ -310,7 +314,9 @@ export function renderSetupResult(result) {
     `cd ${shellQuote(result.projectRoot)}`,
     startCommand,
     '',
-    'Then invoke: /evolve-agent-with-harbor',
+    result.profile === 'web'
+      ? 'Open the Harbor tab, or invoke: /evolve-agent-with-harbor'
+      : 'Then invoke: /evolve-agent-with-harbor',
   )
   return lines.join('\n')
 }

package/lib/web.js

@@ -0,0 +1,76 @@
+export const DASHBOARD_ROUTE = '/_dsh/harbor-evolution/dashboard'
+export const JOB_ROUTE = '/_dsh/harbor-evolution/job'
+export const TRIALS_ROUTE = '/_dsh/harbor-evolution/trials'
+export const TRIAL_ROUTE = '/_dsh/harbor-evolution/trial'
+
+function sendJson(response, status, body) {
+  response.writeHead(status, {
+    'cache-control': 'no-store',
+    'content-type': 'application/json; charset=utf-8',
+    'x-content-type-options': 'nosniff',
+  })
+  response.end(JSON.stringify(body))
+}
+
+export function isSameOriginRequest(request) {
+  const fetchSite = request.headers['sec-fetch-site']
+  if (fetchSite && fetchSite !== 'same-origin' && fetchSite !== 'none') return false
+  const origin = request.headers.origin
+  if (!origin) {
+    if (fetchSite === 'same-origin' || fetchSite === 'none') return true
+    const address = request.socket?.remoteAddress ?? ''
+    return address === '::1' || address === '127.0.0.1' || address.startsWith('127.') || address.startsWith('::ffff:127.')
+  }
+  const host = request.headers.host
+  if (!host) return false
+  try {
+    const parsed = new URL(origin)
+    return ['http:', 'https:'].includes(parsed.protocol) && parsed.host === host
+  } catch {
+    return false
+  }
+}
+
+function safeError(error) {
+  const message = error instanceof Error ? error.message : String(error)
+  return message.replace(/(?:\/[A-Za-z0-9._ -]+){2,}/g, '[local path]').replace(/[A-Za-z]:\\[^\s]+/g, '[local path]')
+}
+
+export function createApiHandler(load, code = 'request-failed') {
+  return (request, response) => {
+    if (request.method !== 'GET') {
+      response.writeHead(405, { allow: 'GET' })
+      response.end()
+      return
+    }
+    if (!isSameOriginRequest(request)) {
+      sendJson(response, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin request required' } })
+      return
+    }
+    const url = new URL(request.url ?? '/', 'http://localhost')
+    const args = Object.fromEntries(url.searchParams)
+    Promise.resolve(load(args)).then(
+      value => sendJson(response, 200, { ok: true, value }),
+      error => sendJson(response, 500, { ok: false, error: { code, message: safeError(error) } }),
+    )
+  }
+}
+
+export function createDashboardHandler(service) {
+  return createApiHandler(() => service.dashboard(), 'dashboard-unavailable')
+}
+
+export function installDashboardWeb(ctx, service) {
+  if (typeof ctx.inject !== 'function') return
+  ctx.inject(['webServer'], (webCtx) => {
+    const routes = [
+      [DASHBOARD_ROUTE, createDashboardHandler(service)],
+      [JOB_ROUTE, createApiHandler(args => service.job(args), 'job-unavailable')],
+      [TRIALS_ROUTE, createApiHandler(args => service.trials(args), 'trials-unavailable')],
+      [TRIAL_ROUTE, createApiHandler(args => service.trial(args), 'trial-unavailable')],
+    ]
+    for (const [route, handler] of routes) {
+      webCtx.effect(() => webCtx.webServer.register({ kind: 'exact', path: route, handler }), `harbor-evolution: ${route}`)
+    }
+  })
+}

package/package.json

@@ -1,10 +1,15 @@
 {
   "name": "dsh-harbor-evolution",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "DeepSeek Harness plugin and bundled Skill for safely evolving Cordis Candidates with Harbor.",
   "type": "module",
   "main": "index.js",
-  "exports": "./index.js",
+  "exports": {
+    ".": "./index.js",
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
   "bin": {
     "dsh-harbor": "bin/dsh-harbor.mjs"
   },
@@ -18,12 +23,24 @@
     "LICENSE"
   ],
   "scripts": {
+    "build": "node scripts/build-client.mjs",
+    "prepack": "npm run build",
     "test": "node --test",
-    "check": "node --check index.js && node --check bin/dsh-harbor.mjs && node --test"
+    "check": "npm run build && node --check index.js && node --check bin/dsh-harbor.mjs && node --test"
   },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-ui-tool",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
+      "platform": "web"
     }
   },
   "peerDependencies": {
@@ -37,7 +54,9 @@
     "@deepseek-ai/cordis": "4.0.1",
     "@deepseek-ai/dsh-skill": "0.1.0-rc.6",
     "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
-    "@deepseek-ai/schemastery": "3.18.1"
+    "@deepseek-ai/schemastery": "3.18.1",
+    "esbuild": "0.28.2",
+    "react": "18.3.1"
   },
   "engines": {
     "node": ">=22"