kodelyth-ecc 1.5.10 → 1.7.0

package/social/section-parallel.svg

@@ -0,0 +1,72 @@
+<svg viewBox="0 0 900 185" xmlns="http://www.w3.org/2000/svg" font-family="'Segoe UI', system-ui, -apple-system, sans-serif">
+  <defs>
+    <linearGradient id="bg" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" style="stop-color:#0d1117"/>
+      <stop offset="100%" style="stop-color:#161b22"/>
+    </linearGradient>
+    <marker id="arr" markerWidth="7" markerHeight="7" refX="5" refY="3" orient="auto">
+      <path d="M0,0 L5,3 L0,6 Z" fill="#a78bfa" opacity="0.8"/>
+    </marker>
+    <marker id="arrg" markerWidth="7" markerHeight="7" refX="5" refY="3" orient="auto">
+      <path d="M0,0 L5,3 L0,6 Z" fill="#34d399" opacity="0.8"/>
+    </marker>
+  </defs>
+  <rect width="900" height="185" fill="url(#bg)" rx="12"/>
+  <rect width="900" height="185" fill="none" stroke="#21262d" stroke-width="1" rx="12"/>
+
+  <!-- Label — widened to fit text -->
+  <rect x="32" y="20" width="248" height="22" rx="11" fill="#f59e0b" fill-opacity="0.12" stroke="#f59e0b" stroke-opacity="0.4" stroke-width="1"/>
+  <text x="156" y="35" font-size="10" fill="#fbbf24" text-anchor="middle" font-weight="700" letter-spacing="1">PARALLEL MULTI-AGENT COMMANDS</text>
+
+  <text x="32" y="72" font-size="21" font-weight="800" fill="#ffffff">8 specialists fire simultaneously — not one by one</text>
+  <text x="32" y="94" font-size="12" fill="#6e7681">60 min sequential review → 15 min parallel  ·  all results aggregated into one structured report</text>
+
+  <!-- Command trigger box -->
+  <rect x="32" y="112" width="120" height="56" rx="7" fill="#161b22" stroke="#a78bfa" stroke-opacity="0.5" stroke-width="1"/>
+  <text x="92" y="132" font-size="10" fill="#a78bfa" text-anchor="middle" font-weight="700">/team-review</text>
+  <text x="92" y="148" font-size="8" fill="#6e7681" text-anchor="middle">one command</text>
+  <text x="92" y="160" font-size="8" fill="#6e7681" text-anchor="middle">fires 4 agents</text>
+
+  <!-- Fan-out lines to 4 agents -->
+  <line x1="155" y1="122" x2="196" y2="115" stroke="#a78bfa" stroke-width="1" marker-end="url(#arr)" opacity="0.6"/>
+  <line x1="155" y1="131" x2="196" y2="131" stroke="#a78bfa" stroke-width="1" marker-end="url(#arr)" opacity="0.6"/>
+  <line x1="155" y1="140" x2="196" y2="147" stroke="#a78bfa" stroke-width="1" marker-end="url(#arr)" opacity="0.6"/>
+  <line x1="155" y1="149" x2="196" y2="163" stroke="#a78bfa" stroke-width="1" marker-end="url(#arr)" opacity="0.6"/>
+
+  <!-- 4 agent pills — 130px wide each, text fits at font-size 9 -->
+  <rect x="199" y="106" width="130" height="20" rx="5" fill="#a78bfa" fill-opacity="0.12" stroke="#a78bfa" stroke-opacity="0.4" stroke-width="1"/>
+  <text x="264" y="119" font-size="9" fill="#a78bfa" text-anchor="middle" font-weight="600">code-reviewer</text>
+
+  <rect x="199" y="122" width="130" height="20" rx="5" fill="#ef4444" fill-opacity="0.1" stroke="#ef4444" stroke-opacity="0.35" stroke-width="1"/>
+  <text x="264" y="135" font-size="9" fill="#f87171" text-anchor="middle" font-weight="600">security-reviewer</text>
+
+  <rect x="199" y="138" width="130" height="20" rx="5" fill="#f59e0b" fill-opacity="0.1" stroke="#f59e0b" stroke-opacity="0.35" stroke-width="1"/>
+  <text x="264" y="151" font-size="9" fill="#fbbf24" text-anchor="middle" font-weight="600">performance-optimizer</text>
+
+  <rect x="199" y="154" width="130" height="20" rx="5" fill="#2563eb" fill-opacity="0.1" stroke="#2563eb" stroke-opacity="0.35" stroke-width="1"/>
+  <text x="264" y="167" font-size="9" fill="#60a5fa" text-anchor="middle" font-weight="600">api-guardian</text>
+
+  <!-- Fan-in lines to result -->
+  <line x1="332" y1="115" x2="370" y2="132" stroke="#34d399" stroke-width="1" marker-end="url(#arrg)" opacity="0.6"/>
+  <line x1="332" y1="131" x2="370" y2="136" stroke="#34d399" stroke-width="1" marker-end="url(#arrg)" opacity="0.6"/>
+  <line x1="332" y1="147" x2="370" y2="140" stroke="#34d399" stroke-width="1" marker-end="url(#arrg)" opacity="0.6"/>
+  <line x1="332" y1="163" x2="370" y2="144" stroke="#34d399" stroke-width="1" marker-end="url(#arrg)" opacity="0.6"/>
+
+  <!-- Result box -->
+  <rect x="373" y="112" width="148" height="56" rx="7" fill="#059669" fill-opacity="0.1" stroke="#059669" stroke-opacity="0.4" stroke-width="1"/>
+  <text x="447" y="131" font-size="10" fill="#34d399" text-anchor="middle" font-weight="700">Team Review Report</text>
+  <text x="447" y="147" font-size="8" fill="#34d399" text-anchor="middle" opacity="0.8">CRITICAL · HIGH · MEDIUM</text>
+  <text x="447" y="160" font-size="8" fill="#34d399" text-anchor="middle" opacity="0.75">1 critical found → fix first</text>
+
+  <!-- All 8 parallel commands — two columns -->
+  <text x="546" y="112" font-size="9" fill="#6e7681" font-weight="600">All 8 parallel commands:</text>
+  <text x="546" y="127" font-size="9" fill="#a78bfa">/team-review</text>
+  <text x="546" y="141" font-size="9" fill="#a78bfa">/project-launch</text>
+  <text x="546" y="155" font-size="9" fill="#ef4444">/devil-mode</text>
+  <text x="546" y="169" font-size="9" fill="#f59e0b">/security-audit</text>
+
+  <text x="700" y="127" font-size="9" fill="#38bdf8">/debug-blitz</text>
+  <text x="700" y="141" font-size="9" fill="#38bdf8">/refactor-sprint</text>
+  <text x="700" y="155" font-size="9" fill="#34d399">/pre-release</text>
+  <text x="700" y="169" font-size="9" fill="#34d399">/onboard</text>
+</svg>

package/social/section-routing.svg

@@ -0,0 +1,51 @@
+<svg viewBox="0 0 900 170" xmlns="http://www.w3.org/2000/svg" font-family="'Segoe UI', system-ui, -apple-system, sans-serif">
+  <defs>
+    <linearGradient id="bg" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" style="stop-color:#0d1117"/>
+      <stop offset="100%" style="stop-color:#161b22"/>
+    </linearGradient>
+    <linearGradient id="acc" x1="0%" y1="0%" x2="100%" y2="0%">
+      <stop offset="0%" style="stop-color:#a78bfa"/>
+      <stop offset="100%" style="stop-color:#38bdf8"/>
+    </linearGradient>
+    <marker id="arr" markerWidth="8" markerHeight="8" refX="6" refY="3" orient="auto">
+      <path d="M0,0 L6,3 L0,6 Z" fill="#a78bfa" opacity="0.7"/>
+    </marker>
+  </defs>
+  <rect width="900" height="170" fill="url(#bg)" rx="12"/>
+  <rect width="900" height="170" fill="none" stroke="#21262d" stroke-width="1" rx="12"/>
+
+  <!-- Section label -->
+  <rect x="32" y="20" width="180" height="22" rx="11" fill="#a78bfa" fill-opacity="0.12" stroke="#a78bfa" stroke-opacity="0.35" stroke-width="1"/>
+  <text x="122" y="35" font-size="10" fill="#a78bfa" text-anchor="middle" font-weight="700" letter-spacing="1">INTENT ROUTING SYSTEM</text>
+
+  <!-- Title -->
+  <text x="32" y="72" font-size="22" font-weight="800" fill="#ffffff">Plain language → right specialist — automatically</text>
+  <text x="32" y="96" font-size="12" fill="#6e7681">The 10-tier routing rule fires on every session. No agent names needed. The AI announces who's taking over.</text>
+
+  <!-- Flow diagram -->
+  <rect x="32" y="118" width="120" height="40" rx="6" fill="#21262d" stroke="#30363d" stroke-width="1"/>
+  <text x="92" y="138" font-size="10" fill="#c9d1d9" text-anchor="middle">"I've been stuck for</text>
+  <text x="92" y="152" font-size="10" fill="#c9d1d9" text-anchor="middle">hours on this bug"</text>
+
+  <line x1="155" y1="138" x2="195" y2="138" stroke="#a78bfa" stroke-width="1.5" marker-end="url(#arr)" opacity="0.7"/>
+
+  <rect x="198" y="118" width="108" height="40" rx="6" fill="#a78bfa" fill-opacity="0.15" stroke="#a78bfa" stroke-opacity="0.5" stroke-width="1"/>
+  <text x="252" y="136" font-size="10" fill="#a78bfa" text-anchor="middle" font-weight="700">10-tier router</text>
+  <text x="252" y="150" font-size="9" fill="#a78bfa" text-anchor="middle" opacity="0.7">frustration + error signal</text>
+
+  <line x1="309" y1="138" x2="349" y2="138" stroke="#a78bfa" stroke-width="1.5" marker-end="url(#arr)" opacity="0.7"/>
+
+  <rect x="352" y="118" width="130" height="40" rx="6" fill="#38bdf8" fill-opacity="0.12" stroke="#38bdf8" stroke-opacity="0.4" stroke-width="1"/>
+  <text x="417" y="136" font-size="10" fill="#38bdf8" text-anchor="middle" font-weight="700">→ debug-detective</text>
+  <text x="417" y="150" font-size="9" fill="#38bdf8" text-anchor="middle" opacity="0.7">root-cause analyst</text>
+
+  <line x1="485" y1="138" x2="525" y2="138" stroke="#6e7681" stroke-width="1" stroke-dasharray="4,3" opacity="0.5"/>
+
+  <rect x="528" y="118" width="155" height="40" rx="6" fill="#059669" fill-opacity="0.1" stroke="#059669" stroke-opacity="0.4" stroke-width="1"/>
+  <text x="605" y="135" font-size="9.5" fill="#34d399" text-anchor="middle">"Tip: next time type</text>
+  <text x="605" y="149" font-size="9.5" fill="#34d399" text-anchor="middle">'use debug-detective'"</text>
+
+  <!-- Right label -->
+  <text x="868" y="96" font-size="10" fill="#6e7681" text-anchor="end">70 agents  ·  10 tiers  ·  50+ patterns</text>
+</svg>

package/social/x-card-agents-grid.svg

@@ -19,7 +19,7 @@
   <circle cx="100" cy="100" r="200" fill="#a78bfa" opacity="0.03"/>
 
   <!-- Header -->
-  <text x="80" y="72" font-size="48" font-weight="900" letter-spacing="-2" fill="#ffffff">62 agents. One install.</text>
+  <text x="80" y="72" font-size="48" font-weight="900" letter-spacing="-2" fill="#ffffff">70 agents. One install.</text>
   <text x="80" y="110" font-size="18" fill="#6e7681">Semantic routing picks the right one — you never need to know their names.</text>
 
   <!-- Left column — agent cards -->
@@ -91,18 +91,18 @@
   <text x="460" y="608" font-size="12" fill="#484f58" text-anchor="middle">Works with Claude Code · Windsurf · Cursor · Codex · Antigravity · OpenCode</text>
 
   <!-- Stats -->
-  <text x="920" y="200" font-size="72" font-weight="900" fill="#ffffff" text-anchor="middle">62</text>
+  <text x="920" y="200" font-size="72" font-weight="900" fill="#ffffff" text-anchor="middle">70</text>
   <text x="920" y="228" font-size="10" fill="#484f58" text-anchor="middle" letter-spacing="3">AGENTS</text>
   <line x1="860" y1="248" x2="980" y2="248" stroke="#21262d" stroke-width="1"/>
-  <text x="920" y="280" font-size="32" font-weight="800" fill="#ffffff" text-anchor="middle">188</text>
+  <text x="920" y="280" font-size="32" font-weight="800" fill="#ffffff" text-anchor="middle">194</text>
   <text x="920" y="302" font-size="10" fill="#484f58" text-anchor="middle" letter-spacing="2">SKILLS</text>
   <line x1="860" y1="320" x2="980" y2="320" stroke="#21262d" stroke-width="1"/>
-  <text x="920" y="352" font-size="32" font-weight="800" fill="#ffffff" text-anchor="middle">20+</text>
+  <text x="920" y="352" font-size="32" font-weight="800" fill="#ffffff" text-anchor="middle">22+</text>
   <text x="920" y="374" font-size="10" fill="#484f58" text-anchor="middle" letter-spacing="2">HOOKS</text>
   <line x1="860" y1="392" x2="980" y2="392" stroke="#21262d" stroke-width="1"/>
-  <text x="920" y="424" font-size="32" font-weight="800" fill="#ffffff" text-anchor="middle">6</text>
+  <text x="920" y="424" font-size="32" font-weight="800" fill="#ffffff" text-anchor="middle">12</text>
   <text x="920" y="446" font-size="10" fill="#484f58" text-anchor="middle" letter-spacing="2">PLATFORMS</text>
   <line x1="860" y1="464" x2="980" y2="464" stroke="#21262d" stroke-width="1"/>
-  <text x="920" y="496" font-size="20" font-weight="800" fill="#ffffff" text-anchor="middle">v1.5.8</text>
+  <text x="920" y="496" font-size="20" font-weight="800" fill="#ffffff" text-anchor="middle">v1.7.0</text>
   <text x="920" y="516" font-size="10" fill="#484f58" text-anchor="middle" letter-spacing="2">LATEST</text>
 </svg>

package/tests/dashboard/data.test.js

@@ -0,0 +1,235 @@
+// Tests for scripts/dashboard/data.js
+'use strict';
+
+const test   = require('node:test');
+const assert = require('node:assert/strict');
+const fs     = require('node:fs');
+const os     = require('node:os');
+const path   = require('node:path');
+
+// IMPORTANT: the memory store freezes KODELYTH_MEMORY_DIR at require time.
+// Configure a TMP dir before requiring anything that loads it transitively.
+const TMP_MEM = fs.mkdtempSync(path.join(os.tmpdir(), 'kodelyth-dash-mem-suite-'));
+process.env.KODELYTH_MEMORY_DIR = TMP_MEM;
+
+const data        = require('../../scripts/dashboard/data.js');
+const memoryStore = require('../../scripts/memory/store.js');
+
+function tmpDir(prefix) { return fs.mkdtempSync(path.join(os.tmpdir(), prefix)); }
+function cleanup(dir) { try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* */ } }
+
+// ── overview ────────────────────────────────────────────────────────────────
+
+test('overview: returns shape with counts + storage paths even on cold dirs', () => {
+  const memDir    = tmpDir('kodelyth-dash-mem-');
+  const evolveDir = tmpDir('kodelyth-dash-evol-');
+  const coordDir  = tmpDir('kodelyth-dash-coord-');
+  try {
+    const o = data.overview({ memoryDir: memDir, evolveDir, coordRoot: coordDir });
+    assert.equal(o.storage.memory_dir, memDir);
+    assert.equal(o.storage.evolve_dir, evolveDir);
+    assert.equal(o.storage.coord_root, coordDir);
+    assert.ok(typeof o.catalog.agents === 'number');
+    assert.ok(typeof o.catalog.skills === 'number');
+    assert.equal(o.evolve.proposals.pending, 0);
+    assert.equal(o.evolve.proposals.total, 0);
+    assert.equal(o.swarm.sessions, 0);
+    assert.match(o.generated_at, /^\d{4}-\d{2}-\d{2}T/);
+  } finally { cleanup(memDir); cleanup(evolveDir); cleanup(coordDir); }
+});
+
+test('overview: catalog counts are non-zero for the real package root', () => {
+  const o = data.overview();
+  assert.ok(o.catalog.skills > 0, 'skills count > 0 for real install');
+  assert.ok(o.catalog.commands > 0);
+});
+
+// ── memory ──────────────────────────────────────────────────────────────────
+// All memory tests share TMP_MEM (the store freezes its dir at require time).
+// Run order matters: empty assertion → seed → readback.
+
+test('memory: empty store yields empty recent list', () => {
+  // Runs first, before any captures.
+  assert.deepEqual(data.recentMemories({ limit: 5 }), []);
+  assert.equal(data.memoryStats().total, 0);
+});
+
+test('memory: empty query returns []', () => {
+  assert.deepEqual(data.memorySearch({ query: '' }), []);
+  assert.deepEqual(data.memorySearch({}), []);
+});
+
+test('memory: recent + search after seeding two captures', async () => {
+  const m1 = memoryStore.capture({ problem: 'unique-token-tailwind-v4-arbitrary one', approach: 'A1', tags: ['css'], language: 'js' });
+  await new Promise(r => setTimeout(r, 15));
+  const m2 = memoryStore.capture({ problem: 'second-distinct-problem-here',         approach: 'A2', tags: ['ts'],  language: 'ts' });
+
+  const recent = data.recentMemories({ limit: 5 });
+  assert.ok(recent.length >= 2, 'has at least the two captures');
+  // Newest first.
+  const newestId = recent[0].id;
+  assert.equal(newestId, m2.id);
+  assert.ok(recent.some(r => r.id === m1.id));
+  assert.match(recent[0].approach, /^A2/);
+
+  const stats = data.memoryStats();
+  assert.ok(stats.total >= 2);
+  assert.ok(typeof stats.byLanguage === 'object');
+
+  const hits = data.memorySearch({ query: 'unique-token-tailwind-v4-arbitrary', limit: 5 });
+  assert.ok(hits.length >= 1, 'BM25 finds seeded memory');
+  assert.match(hits[0].problem, /unique-token-tailwind-v4-arbitrary/);
+  assert.ok(typeof hits[0].score === 'number');
+});
+
+// ── evolve ──────────────────────────────────────────────────────────────────
+
+test('evolveSnapshot: empty dir → zero counts + empty arrays', () => {
+  const evolveDir = tmpDir('kodelyth-dash-evol-');
+  try {
+    const e = data.evolveSnapshot({ evolveDir });
+    assert.equal(e.reuse.total_memories_tracked, 0);
+    assert.equal(e.reuse.total_surfaces, 0);
+    assert.equal(e.miss.total_misses, 0);
+    assert.deepEqual(e.proposals, []);
+  } finally { cleanup(evolveDir); }
+});
+
+test('evolveSnapshot: surfaces a recorded reuse + proposal', () => {
+  const evolveDir = tmpDir('kodelyth-dash-evol-');
+  try {
+    const stats     = require('../../scripts/evolve/stats.js');
+    const proposals = require('../../scripts/evolve/proposals.js');
+    stats.recordSurface({ memoryId: 'mem-x', sessionId: 's1' }, evolveDir);
+    proposals.appendProposal({
+      id: 'skill-test',
+      type: 'skill-upgrade',
+      proposal: { kind: 'create-skill', target_path: 'skills/x/SKILL.md', diff: '# x', rationale: 'why' },
+    }, evolveDir);
+
+    const e = data.evolveSnapshot({ evolveDir });
+    assert.equal(e.reuse.total_memories_tracked, 1);
+    assert.equal(e.reuse.total_surfaces, 1);
+    assert.equal(e.proposals.length, 1);
+    assert.equal(e.proposals[0].id, 'skill-test');
+    assert.equal(e.proposals[0].status, 'pending');
+    assert.equal(e.proposals[0].target_path, 'skills/x/SKILL.md');
+  } finally { cleanup(evolveDir); }
+});
+
+// ── catalog ─────────────────────────────────────────────────────────────────
+
+test('catalogList: rejects unknown kind by returning []', () => {
+  assert.deepEqual(data.catalogList({ kind: 'junk' }), []);
+});
+
+test('catalogList: returns skills for kind=skills', () => {
+  const items = data.catalogList({ kind: 'skills', limit: 5 });
+  assert.ok(items.length >= 1);
+  assert.ok(typeof items[0].name === 'string');
+});
+
+test('catalogList: query filters by substring', () => {
+  const items = data.catalogList({ kind: 'skills', query: 'self-evolving', limit: 50 });
+  // Phase 3.4 just shipped this skill — must be findable.
+  assert.ok(items.some(it => it.name.includes('self-evolving')), 'finds self-evolving-memory skill');
+});
+
+test('catalogList: limit caps results', () => {
+  const items = data.catalogList({ kind: 'skills', limit: 3 });
+  assert.ok(items.length <= 3);
+});
+
+test('catalogCounts: matches stats() shape', () => {
+  const c = data.catalogCounts();
+  for (const k of ['agents', 'skills', 'commands', 'rules', 'bundles']) {
+    assert.ok(typeof c[k] === 'number');
+  }
+});
+
+// ── sessions ────────────────────────────────────────────────────────────────
+
+test('sessionsList: missing coord dir returns []', () => {
+  assert.deepEqual(data.sessionsList({ coordRoot: '/tmp/__never_exists_xyz_kodelyth' }), []);
+});
+
+test('sessionsList: returns sessions with worker counts', () => {
+  const root = tmpDir('kodelyth-dash-coord-');
+  try {
+    fs.mkdirSync(path.join(root, 'sess-A', 'worker-1'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'sess-A', 'worker-2'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'sess-B', 'worker-1'), { recursive: true });
+    const list = data.sessionsList({ coordRoot: root });
+    assert.equal(list.length, 2);
+    const a = list.find(s => s.session === 'sess-A');
+    assert.equal(a.worker_count, 2);
+    assert.deepEqual(a.workers.sort(), ['worker-1', 'worker-2']);
+  } finally { cleanup(root); }
+});
+
+test('sessionDetail: returns null for missing session', () => {
+  assert.equal(data.sessionDetail({ session: 'nope', coordRoot: '/tmp/__never_exists_xyz_kodelyth' }), null);
+});
+
+test('sessionDetail: reads task/handoff/status excerpts', () => {
+  const root = tmpDir('kodelyth-dash-coord-');
+  try {
+    const wdir = path.join(root, 'sess-X', 'worker-1');
+    fs.mkdirSync(wdir, { recursive: true });
+    fs.writeFileSync(path.join(wdir, 'task.md'),    '# task\nbody\n');
+    fs.writeFileSync(path.join(wdir, 'handoff.md'), '# handoff\nhello\n');
+    const d = data.sessionDetail({ session: 'sess-X', coordRoot: root });
+    assert.ok(d);
+    assert.equal(d.workers.length, 1);
+    const w = d.workers[0];
+    assert.equal(w.has_task, true);
+    assert.equal(w.has_handoff, true);
+    assert.equal(w.has_status, false);
+    assert.match(w.task_excerpt, /^# task/);
+    assert.match(w.handoff_excerpt, /hello/);
+  } finally { cleanup(root); }
+});
+
+test('safeReadExcerpt: truncates large files', () => {
+  const tmp = tmpDir('kodelyth-dash-trunc-');
+  const f = path.join(tmp, 'big.md');
+  try {
+    fs.writeFileSync(f, 'x'.repeat(5000));
+    const ex = data._internals.safeReadExcerpt(f, 100);
+    assert.ok(ex.endsWith('…(truncated)'));
+    assert.ok(ex.length < 5000);
+  } finally { cleanup(tmp); }
+});
+
+// ── token budget ────────────────────────────────────────────────────────────
+
+test('tokenBudgetSnapshot: missing dir → empty result', () => {
+  const r = data.tokenBudgetSnapshot({ budgetDir: '/tmp/__never_exists_kodelyth_budget' });
+  assert.deepEqual(r, { sessions: [], total_tokens: 0 });
+});
+
+test('tokenBudgetSnapshot: aggregates JSON budget files', () => {
+  const dir = tmpDir('kodelyth-dash-budget-');
+  try {
+    fs.writeFileSync(path.join(dir, 'budget-s1.json'),
+      JSON.stringify({ session_id: 's1', tokens: 1234, budget: 10000, mode: 'warn', last_event: '2026-05-10T10:00:00Z' }));
+    fs.writeFileSync(path.join(dir, 'budget-s2.json'),
+      JSON.stringify({ session_id: 's2', tokens: 5678, budget: 10000, mode: 'warn', last_event: '2026-05-10T11:00:00Z' }));
+    const r = data.tokenBudgetSnapshot({ budgetDir: dir });
+    assert.equal(r.sessions.length, 2);
+    assert.equal(r.total_tokens, 1234 + 5678);
+    assert.equal(r.sessions[0].session_id, 's2', 'sorted by last_event desc');
+  } finally { cleanup(dir); }
+});
+
+test('tokenBudgetSnapshot: silently skips malformed budget files', () => {
+  const dir = tmpDir('kodelyth-dash-budget-');
+  try {
+    fs.writeFileSync(path.join(dir, 'budget-broken.json'), 'not-json{{{');
+    fs.writeFileSync(path.join(dir, 'budget-good.json'),
+      JSON.stringify({ session_id: 'good', tokens: 100 }));
+    const r = data.tokenBudgetSnapshot({ budgetDir: dir });
+    assert.equal(r.sessions.length, 1, 'only good file counted');
+    assert.equal(r.total_tokens, 100);
+  } finally { cleanup(dir); }
+});

package/tests/dashboard/server.test.js

@@ -0,0 +1,240 @@
+// Smoke tests for scripts/dashboard/server.js
+//
+// We boot the real HTTP server on an ephemeral localhost port, exercise
+// every route via the built-in `http` module (no external HTTP client),
+// and assert response shapes + security posture.
+'use strict';
+
+const test   = require('node:test');
+const assert = require('node:assert/strict');
+const http   = require('node:http');
+
+const { createServer, _internals } = require('../../scripts/dashboard/server.js');
+const dashboard = require('../../scripts/dashboard/server.js');
+
+// ── helpers ──────────────────────────────────────────────────────────────────
+
+function listenEphemeral(server) {
+  return new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => resolve(server.address().port));
+  });
+}
+
+function get(port, path, { method = 'GET', headers = {} } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path, method, headers }, res => {
+      const chunks = [];
+      res.on('data', c => chunks.push(c));
+      res.on('end', () => resolve({
+        status:  res.statusCode,
+        headers: res.headers,
+        body:    Buffer.concat(chunks).toString('utf8'),
+      }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+function shutdown(server) {
+  return new Promise(resolve => server.close(resolve));
+}
+
+// ── tests ───────────────────────────────────────────────────────────────────
+
+test('GET /api/health returns ok+time', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/health');
+    assert.equal(r.status, 200);
+    const body = JSON.parse(r.body);
+    assert.equal(body.ok, true);
+    assert.match(body.time, /^\d{4}-\d{2}-\d{2}T/);
+  } finally { await shutdown(server); }
+});
+
+test('GET /api/overview returns shape', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/overview');
+    assert.equal(r.status, 200);
+    const body = JSON.parse(r.body);
+    assert.ok(body.catalog);
+    assert.ok(body.memory);
+    assert.ok(body.evolve);
+    assert.ok(body.swarm);
+    assert.ok(body.storage);
+  } finally { await shutdown(server); }
+});
+
+test('GET /api/memory returns stats + recent', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/memory?limit=5');
+    assert.equal(r.status, 200);
+    const body = JSON.parse(r.body);
+    assert.ok(body.stats);
+    assert.ok(Array.isArray(body.recent));
+  } finally { await shutdown(server); }
+});
+
+test('GET /api/memory/search rejects missing q', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/memory/search');
+    assert.equal(r.status, 400);
+    const body = JSON.parse(r.body);
+    assert.match(body.error, /q/);
+  } finally { await shutdown(server); }
+});
+
+test('GET /api/evolve returns reuse + miss + proposals', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/evolve');
+    assert.equal(r.status, 200);
+    const body = JSON.parse(r.body);
+    assert.ok(body.reuse);
+    assert.ok(body.miss);
+    assert.ok(Array.isArray(body.proposals));
+  } finally { await shutdown(server); }
+});
+
+test('GET /api/catalog?kind=skills returns items', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/catalog?kind=skills&limit=5');
+    assert.equal(r.status, 200);
+    const body = JSON.parse(r.body);
+    assert.equal(body.kind, 'skills');
+    assert.ok(body.counts);
+    assert.ok(Array.isArray(body.items));
+  } finally { await shutdown(server); }
+});
+
+test('GET /api/catalog rejects bad kind with 400', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/catalog?kind=junk');
+    assert.equal(r.status, 400);
+    const body = JSON.parse(r.body);
+    assert.match(body.error, /kind/);
+  } finally { await shutdown(server); }
+});
+
+test('GET /api/sessions returns array', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/sessions');
+    assert.equal(r.status, 200);
+    const body = JSON.parse(r.body);
+    assert.ok(Array.isArray(body.sessions));
+  } finally { await shutdown(server); }
+});
+
+test('GET /api/sessions/:nonexistent returns 404', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/sessions/this-session-never-exists-xyz');
+    assert.equal(r.status, 404);
+  } finally { await shutdown(server); }
+});
+
+test('GET /api/token-budget returns aggregate shape', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/token-budget');
+    assert.equal(r.status, 200);
+    const body = JSON.parse(r.body);
+    assert.ok(Array.isArray(body.sessions));
+    assert.ok(typeof body.total_tokens === 'number');
+  } finally { await shutdown(server); }
+});
+
+test('GET /api/missing-route returns 404', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/totally-made-up');
+    assert.equal(r.status, 404);
+  } finally { await shutdown(server); }
+});
+
+test('POST is rejected with 405', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/health', { method: 'POST' });
+    assert.equal(r.status, 405);
+    assert.equal(r.headers.allow, 'GET');
+  } finally { await shutdown(server); }
+});
+
+test('static root serves index.html', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/');
+    assert.equal(r.status, 200);
+    assert.match(r.headers['content-type'], /^text\/html/);
+    assert.match(r.body, /Kodelyth ECC/);
+  } finally { await shutdown(server); }
+});
+
+test('hardened headers on every response', async () => {
+  const server = createServer();
+  const port = await listenEphemeral(server);
+  try {
+    const r = await get(port, '/api/health');
+    assert.equal(r.headers['x-frame-options'], 'DENY');
+    assert.equal(r.headers['x-content-type-options'], 'nosniff');
+    assert.equal(r.headers['referrer-policy'], 'no-referrer');
+    assert.equal(r.headers['cache-control'], 'no-store');
+  } finally { await shutdown(server); }
+});
+
+test('start() refuses non-localhost without override', async () => {
+  await assert.rejects(
+    () => dashboard.start({ port: 0, host: '0.0.0.0', openBrowser: false, log: () => {} }),
+    /refusing to bind/,
+  );
+});
+
+test('start() allows non-localhost when override env var is set', async () => {
+  const oldEnv = process.env.KODELYTH_DASHBOARD_ALLOW_REMOTE;
+  process.env.KODELYTH_DASHBOARD_ALLOW_REMOTE = '1';
+  try {
+    const { server } = await dashboard.start({ port: 0, host: '127.0.0.1', openBrowser: false, log: () => {} });
+    await shutdown(server);
+  } finally {
+    if (oldEnv === undefined) delete process.env.KODELYTH_DASHBOARD_ALLOW_REMOTE;
+    else process.env.KODELYTH_DASHBOARD_ALLOW_REMOTE = oldEnv;
+  }
+});
+
+test('resolveStatic rejects path traversal', () => {
+  assert.equal(_internals.resolveStatic('/../etc/passwd'), null);
+  assert.equal(_internals.resolveStatic('/..%2F..%2Fpackage.json'), null);
+});
+
+test('resolveStatic resolves root to index.html', () => {
+  const p = _internals.resolveStatic('/');
+  assert.match(p || '', /index\.html$/);
+});
+
+test('chooseOpenCommand returns an OS-appropriate string', () => {
+  const cmd = _internals.chooseOpenCommand();
+  assert.ok(typeof cmd === 'string');
+  assert.ok(cmd.length > 0);
+});