okengine 0.1.4

package/src/console/ui/vault/dormant.test.ts

@@ -0,0 +1,37 @@
+/**
+ * Dormant secret detection (console §9.8 · §9.16).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { DORMANT_MS, dormantSecrets } from "./dormant.ts";
+import { VAULT_FIXTURE } from "./fixture.ts";
+import type { VaultRecord } from "./types.ts";
+
+describe("dormantSecrets", () => {
+  test("flags never-read secrets and ignores config", () => {
+    const now = 1_700_000_000_000;
+    const neverRead: VaultRecord = {
+      ...VAULT_FIXTURE[0]!,
+      name: "LEGACY_WEBHOOK_SECRET",
+      lastReadAt: null,
+      readers: [],
+    };
+    const dormant = dormantSecrets(
+      [...VAULT_FIXTURE, neverRead],
+      now,
+    );
+    expect(dormant.some((s) => s.name === "LEGACY_WEBHOOK_SECRET")).toBe(true);
+    expect(dormant.some((s) => s.kind === "config")).toBe(false);
+  });
+
+  test("flags secrets unread for 90+ days", () => {
+    const now = 1_700_000_000_000;
+    const stale: VaultRecord = {
+      ...VAULT_FIXTURE[0]!,
+      name: "OLD_KEY",
+      lastReadAt: now - DORMANT_MS - 1,
+    };
+    const dormant = dormantSecrets([stale], now);
+    expect(dormant.map((s) => s.name)).toEqual(["OLD_KEY"]);
+  });
+});

package/src/console/ui/vault/dormant.ts

@@ -0,0 +1,28 @@
+/**
+ * Dormant (dead) secrets — last-read timestamps expose attack surface
+ * that grows by forgetting (console §9.8 · §9.16).
+ */
+
+import type { VaultRecord } from "./types.ts";
+
+/** Secrets unread for this long (or never) are dormant. */
+export const DORMANT_MS = 90 * 86_400_000;
+
+/**
+ * Secrets with no recent read — never read, or idle ≥ 90 days.
+ *
+ * Config values are excluded; only secrets grow attack surface by neglect.
+ *
+ * @param secrets - Vault panel rows
+ * @param now - Clock (epoch ms)
+ */
+export function dormantSecrets(
+  secrets: readonly VaultRecord[],
+  now: number,
+): readonly VaultRecord[] {
+  return secrets.filter((s) => {
+    if (s.kind !== "secret") return false;
+    if (s.lastReadAt == null) return true;
+    return now - s.lastReadAt >= DORMANT_MS;
+  });
+}

package/src/console/ui/vault/export-safe.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+import {
+  assertExportHasNoSecrets,
+  exportSafeList,
+  exportSafeRow,
+} from "./export-safe.ts";
+import { FIXTURE_SECRET_VALUE, VAULT_FIXTURE } from "./fixture.ts";
+
+describe("exportSafe", () => {
+  test("never includes secret cleartext; config cleartext is allowed", () => {
+    const secret = VAULT_FIXTURE[0]!;
+    const config = VAULT_FIXTURE[1]!;
+    const leaked = {
+      ...secret,
+      // Simulate a buggy row that somehow held cleartext — export must scrub.
+      cleartext: FIXTURE_SECRET_VALUE,
+    };
+    const safe = exportSafeRow(leaked);
+    expect(safe.cleartext).toBeNull();
+    expect(JSON.stringify(safe)).not.toContain(FIXTURE_SECRET_VALUE);
+
+    const configSafe = exportSafeRow(config);
+    expect(configSafe.cleartext).toBe("https://app.example.com");
+
+    const list = exportSafeList(VAULT_FIXTURE);
+    assertExportHasNoSecrets(list, [FIXTURE_SECRET_VALUE]);
+    expect(list).toContain("sha256:aaaaaaaaaaaaaaaa");
+    expect(list).toContain("https://app.example.com");
+  });
+});

package/src/console/ui/vault/export-safe.ts

@@ -0,0 +1,65 @@
+/**
+ * Export / log safety — Vault panel payloads must never carry secret values.
+ */
+
+import type { VaultRecord } from "./types.ts";
+
+/**
+ * Project a row for export/clipboard — fingerprints only for secrets;
+ * config cleartext is allowed.
+ *
+ * @param row - Vault row
+ */
+export function exportSafeRow(row: VaultRecord): Record<string, unknown> {
+  return {
+    name: row.name,
+    kind: row.kind,
+    sensitive: row.sensitive,
+    description: row.description ?? null,
+    rotate: row.rotate ?? null,
+    fingerprints: { ...row.fingerprints },
+    fingerprint: row.fingerprint,
+    cleartext: row.sensitive ? null : row.cleartext,
+    winner: row.winner,
+    resolution: row.resolution.map((s) => ({ ...s })),
+    readers: [...row.readers],
+    blastRadius: {
+      count: row.blastRadius.count,
+      longestWakeAt: row.blastRadius.longestWakeAt,
+      longestOutstandingMs: row.blastRadius.longestOutstandingMs,
+      runIds: [...row.blastRadius.runIds],
+    },
+    lastReadAt: row.lastReadAt,
+    sharedFingerprintEnvs: [...row.sharedFingerprintEnvs],
+  };
+}
+
+/**
+ * Serialize list for export — never includes secret cleartext.
+ *
+ * @param rows - Vault rows
+ */
+export function exportSafeList(rows: readonly VaultRecord[]): string {
+  return JSON.stringify(
+    rows.map((r) => exportSafeRow(r)),
+    null,
+    2,
+  );
+}
+
+/**
+ * Assert a serialized payload does not contain known secret values.
+ *
+ * @param payload - Serialized text
+ * @param knownSecrets - Cleartext secrets that must not appear
+ */
+export function assertExportHasNoSecrets(
+  payload: string,
+  knownSecrets: readonly string[],
+): void {
+  for (const secret of knownSecrets) {
+    if (secret.length > 0 && payload.includes(secret)) {
+      throw new Error("vault export leaked a secret value");
+    }
+  }
+}

package/src/console/ui/vault/fixture.ts

@@ -0,0 +1,75 @@
+/**
+ * Vault panel fixture — fingerprints only; never real secret values.
+ */
+
+import type { VaultListResponse, VaultRecord } from "./types.ts";
+
+/** Fixture secret used only for leak-detection tests (never in panel rows). */
+export const FIXTURE_SECRET_VALUE = "sk_live_DO_NOT_LEAK_fixture";
+
+/** One secret + one config for axe / unit tests. */
+export const VAULT_FIXTURE: readonly VaultRecord[] = [
+  {
+    name: "STRIPE_KEY",
+    kind: "secret",
+    sensitive: true,
+    description: "Payments gateway key",
+    rotate: "90d",
+    fingerprints: {
+      dev: "sha256:aaaaaaaaaaaaaaaa",
+      staging: "sha256:aaaaaaaaaaaaaaaa",
+      prod: "sha256:bbbbbbbbbbbbbbbb",
+    },
+    fingerprint: "sha256:aaaaaaaaaaaaaaaa",
+    cleartext: null,
+    winner: ".env.local",
+    resolution: [
+      { source: "process.env", present: false, won: false },
+      { source: ".env.local", present: true, won: true },
+      { source: ".env.stack", present: false, won: false },
+      { source: "driver", present: false, won: false },
+      { source: "dev-fallback", present: false, won: false },
+    ],
+    readers: ["payments.charge", "payments.refund"],
+    blastRadius: {
+      count: 2,
+      longestWakeAt: 1_800_000_000_000,
+      longestOutstandingMs: 86_400_000,
+      runIds: ["run_sleep_1", "run_sleep_2"],
+    },
+    lastReadAt: 1_700_000_000_000,
+    sharedFingerprintEnvs: ["staging"],
+  },
+  {
+    name: "PUBLIC_APP_URL",
+    kind: "config",
+    sensitive: false,
+    description: "Public site origin",
+    fingerprints: {},
+    fingerprint: null,
+    cleartext: "https://app.example.com",
+    winner: "process.env",
+    resolution: [
+      { source: "process.env", present: true, won: true },
+      { source: ".env.local", present: false, won: false },
+      { source: ".env.stack", present: false, won: false },
+      { source: "driver", present: false, won: false },
+      { source: "dev-fallback", present: false, won: false },
+    ],
+    readers: ["site.render"],
+    blastRadius: {
+      count: 0,
+      longestWakeAt: null,
+      longestOutstandingMs: null,
+      runIds: [],
+    },
+    lastReadAt: null,
+    sharedFingerprintEnvs: [],
+  },
+];
+
+/** List response matching `console.vault.list`. */
+export const VAULT_LIST_FIXTURE: VaultListResponse = {
+  secrets: VAULT_FIXTURE,
+  env: "dev",
+};

package/src/console/ui/vault/group.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, test } from "bun:test";
+import { VAULT_FIXTURE } from "./fixture.ts";
+import { groupByKind, matchesQuery } from "./group.ts";
+
+describe("groupByKind", () => {
+  test("groups secrets and config", () => {
+    const groups = groupByKind(VAULT_FIXTURE);
+    expect(groups.map((g) => g.kind)).toEqual(["secret", "config"]);
+    expect(groups[0]?.secrets[0]?.name).toBe("STRIPE_KEY");
+    expect(groups[1]?.secrets[0]?.name).toBe("PUBLIC_APP_URL");
+  });
+
+  test("filters by query", () => {
+    const groups = groupByKind(VAULT_FIXTURE, "public");
+    expect(groups).toHaveLength(1);
+    expect(groups[0]?.kind).toBe("config");
+  });
+});
+
+describe("matchesQuery", () => {
+  test("matches name case-insensitively", () => {
+    expect(matchesQuery(VAULT_FIXTURE[0]!, "stripe")).toBe(true);
+    expect(matchesQuery(VAULT_FIXTURE[0]!, "nope")).toBe(false);
+  });
+});

package/src/console/ui/vault/group.ts

@@ -0,0 +1,50 @@
+/**
+ * Group vault contracts — secrets vs non-sensitive config (console §9.8).
+ */
+
+import type { VaultKindGroup, VaultRecord } from "./types.ts";
+
+/**
+ * Group secrets and config; optional case-insensitive name/description filter.
+ *
+ * @param secrets - Vault rows
+ * @param query - Optional filter
+ */
+export function groupByKind(
+  secrets: readonly VaultRecord[],
+  query = "",
+): readonly VaultKindGroup[] {
+  const q = query.trim().toLowerCase();
+  const filtered = q
+    ? secrets.filter(
+        (s) =>
+          s.name.toLowerCase().includes(q) ||
+          (s.description?.toLowerCase().includes(q) ?? false),
+      )
+    : secrets;
+
+  const order: Array<"secret" | "config"> = ["secret", "config"];
+  const labels = { secret: "Secrets", config: "Config" } as const;
+  return order
+    .map((kind) => ({
+      kind,
+      label: labels[kind],
+      secrets: filtered.filter((s) => s.kind === kind),
+    }))
+    .filter((g) => g.secrets.length > 0);
+}
+
+/**
+ * Case-insensitive name match helper.
+ *
+ * @param secret - Row
+ * @param query - Filter
+ */
+export function matchesQuery(secret: VaultRecord, query: string): boolean {
+  const q = query.trim().toLowerCase();
+  if (!q) return true;
+  return (
+    secret.name.toLowerCase().includes(q) ||
+    (secret.description?.toLowerCase().includes(q) ?? false)
+  );
+}

package/src/console/ui/vault/index.ts

@@ -0,0 +1,45 @@
+/**
+ * Vault panel pure modules (console §9.8).
+ */
+
+export type {
+  VaultBlastRadius,
+  VaultKindGroup,
+  VaultListResponse,
+  VaultRecord,
+  VaultResolutionSource,
+  VaultResolutionStep,
+} from "./types.ts";
+
+export {
+  VAULT_FIXTURE,
+  VAULT_LIST_FIXTURE,
+  FIXTURE_SECRET_VALUE,
+} from "./fixture.ts";
+
+export {
+  parseVaultSearch,
+  serializeVaultSearch,
+  openVault,
+  closeVault,
+  type VaultSearch,
+} from "./search.ts";
+
+export { groupByKind, matchesQuery } from "./group.ts";
+
+export {
+  setConfirmation,
+  rotateConfirmation,
+  validateTypedConfirm,
+  type ConfirmationPattern,
+} from "./confirmation.ts";
+
+export { formatBlastRadius, formatDuration } from "./blast-radius.ts";
+
+export { dormantSecrets, DORMANT_MS } from "./dormant.ts";
+
+export {
+  exportSafeRow,
+  exportSafeList,
+  assertExportHasNoSecrets,
+} from "./export-safe.ts";

package/src/console/ui/vault/search.ts

@@ -0,0 +1,62 @@
+/**
+ * URL search state for the Vault panel.
+ */
+
+import { z } from "zod";
+
+const VaultSearchSchema = z.object({
+  q: z.string().optional(),
+  name: z.string().optional(),
+  /** Active write action in the detail pane. */
+  action: z.enum(["set", "rotate"]).optional(),
+});
+
+/** Parsed Vault URL search. */
+export type VaultSearch = z.infer<typeof VaultSearchSchema>;
+
+/**
+ * Parse Vault panel search params.
+ *
+ * @param search - Raw router search
+ */
+export function parseVaultSearch(
+  search: Record<string, unknown>,
+): VaultSearch {
+  const parsed = VaultSearchSchema.safeParse(search);
+  return parsed.success ? parsed.data : {};
+}
+
+/**
+ * Serialize Vault search for navigation (omit empties).
+ *
+ * @param search - Search state
+ */
+export function serializeVaultSearch(
+  search: VaultSearch,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  if (search.q) out.q = search.q;
+  if (search.name) out.name = search.name;
+  if (search.action) out.action = search.action;
+  return out;
+}
+
+/**
+ * Open a vault contract in the URL.
+ *
+ * @param search - Current search
+ * @param name - Contract name
+ */
+export function openVault(search: VaultSearch, name: string): VaultSearch {
+  return { ...search, name, action: undefined };
+}
+
+/**
+ * Close the open vault detail.
+ *
+ * @param search - Current search
+ */
+export function closeVault(search: VaultSearch): VaultSearch {
+  const { name: _n, action: _a, ...rest } = search;
+  return rest;
+}

package/src/console/ui/vault/types.ts

@@ -0,0 +1,57 @@
+/**
+ * Vault panel types (console §9.8).
+ */
+
+/** Resolution layer id — matches VaultRuntime sources. */
+export type VaultResolutionSource =
+  | "process.env"
+  | ".env.local"
+  | ".env.stack"
+  | "driver"
+  | "dev-fallback";
+
+/** One step in the full resolution chain. */
+export interface VaultResolutionStep {
+  readonly source: VaultResolutionSource;
+  readonly present: boolean;
+  readonly won: boolean;
+}
+
+/** Journal-queried rotation blast radius. */
+export interface VaultBlastRadius {
+  readonly count: number;
+  readonly longestWakeAt: number | null;
+  readonly longestOutstandingMs: number | null;
+  readonly runIds: readonly string[];
+}
+
+/** One vault contract in the operator list. */
+export interface VaultRecord {
+  readonly name: string;
+  readonly kind: "secret" | "config";
+  readonly sensitive: boolean;
+  readonly description?: string;
+  readonly rotate?: string;
+  readonly fingerprints: Readonly<Record<string, string>>;
+  readonly fingerprint: string | null;
+  readonly cleartext: string | null;
+  readonly winner: VaultResolutionSource | null;
+  readonly resolution: readonly VaultResolutionStep[];
+  readonly readers: readonly string[];
+  readonly blastRadius: VaultBlastRadius;
+  readonly lastReadAt: number | null;
+  readonly sharedFingerprintEnvs: readonly string[];
+}
+
+/** `console.vault.list` response. */
+export interface VaultListResponse {
+  readonly secrets: readonly VaultRecord[];
+  readonly env: string;
+}
+
+/** Grouped list section (secrets vs config). */
+export interface VaultKindGroup {
+  readonly kind: "secret" | "config";
+  readonly label: string;
+  readonly secrets: readonly VaultRecord[];
+}

package/src/console/ui/vite.config.ts

@@ -0,0 +1,84 @@
+/**
+ * Vite build for the Console SPA shell (console §7).
+ * Output is shipped inside the package and served by Bun on 6533.
+ */
+
+import tailwindcss from "@tailwindcss/vite";
+import react from "@vitejs/plugin-react";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { defineConfig } from "vite";
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Panel chunk id from a module path, or `undefined` for the shell entry.
+ *
+ * Every lazy panel must resolve to `panel-<id>` so:
+ * 1. budget measurement can exclude them from the initial load
+ * 2. `modulePreload` can refuse to eagerly fetch them
+ *
+ * @param id - Rollup module id
+ */
+function panelChunkOf(id: string): string | undefined {
+  const panels: ReadonlyArray<readonly [string, string]> = [
+    ["flows", "panel-flows"],
+    ["traces", "panel-traces"],
+    ["runs", "panel-runs"],
+    ["signals", "panel-signals"],
+    ["store", "panel-store"],
+    ["clock", "panel-clock"],
+    ["vault", "panel-vault"],
+    ["ai", "panel-ai"],
+    ["diff", "panel-diff"],
+    ["architecture", "panel-architecture"],
+    ["access", "panel-access"],
+    ["plugins", "panel-plugins"],
+    ["channels", "panel-channels"],
+    ["gates", "panel-gates"],
+    ["overview", "panel-overview"],
+  ];
+  for (const [name, chunk] of panels) {
+    const pascal = name[0]!.toUpperCase() + name.slice(1);
+    if (
+      id.includes(`/console/ui/shell/panels/${name}/`) ||
+      id.includes(`/console/ui/shell/panels/${pascal}.`) ||
+      id.includes(`/console/ui/${name}/`) ||
+      (name === "flows" && id.includes("@codemirror/"))
+    ) {
+      return chunk;
+    }
+  }
+  return undefined;
+}
+
+export default defineConfig({
+  root: resolve(here, "shell"),
+  plugins: [react(), tailwindcss()],
+  build: {
+    outDir: resolve(here, "dist"),
+    emptyOutDir: true,
+    sourcemap: false,
+    target: "esnext",
+    cssCodeSplit: false,
+    // Lazy panels must stay lazy on the wire — Vite's default modulepreload
+    // of every dynamic import was pulling all 17 panel chunks into the first
+    // navigation (the unexplained 89→138 kB class of "initial" measurements).
+    modulePreload: {
+      resolveDependencies(_filename, deps) {
+        return deps.filter((dep) => !dep.includes("panel-"));
+      },
+    },
+    rollupOptions: {
+      output: {
+        manualChunks(id) {
+          return panelChunkOf(id);
+        },
+      },
+    },
+  },
+  server: {
+    port: 6534,
+    strictPort: true,
+  },
+});

package/src/console/xss.gate.test.ts

@@ -0,0 +1,118 @@
+/**
+ * XSS build gate — no `dangerouslySetInnerHTML` / raw HTML injection in Console UI.
+ *
+ * console §10.2: this is a build gate, not a review convention.
+ *
+ * The scan walks all of `src/console/ui` recursively (not a hard-coded panel
+ * list from Prompt 16). The panel-directory assertion below fails the build
+ * if a new `ui/<panel>` folder appears without being covered by that walk.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { readdir } from "node:fs/promises";
+import { join } from "node:path";
+
+const UI_ROOT = `${import.meta.dir}/ui`;
+
+/**
+ * Panel feature directories that must be covered by the XSS scan today.
+ * Update this list when a 18th panel lands — the recursive walk already
+ * covers it; the list makes coverage explicit in CI output.
+ */
+export const CONSOLE_UI_PANEL_DIRS = [
+  "access",
+  "ai",
+  "architecture",
+  "channels",
+  "clock",
+  "diff",
+  "flows",
+  "gates",
+  "overview",
+  "plugins",
+  "runs",
+  "signals",
+  "store",
+  "traces",
+  "vault",
+] as const;
+
+/** Patterns that fail the gate. */
+const FORBIDDEN = [
+  /dangerouslySetInnerHTML/,
+  /\.innerHTML\s*=/,
+  /document\.write\s*\(/,
+  /insertAdjacentHTML\s*\(/,
+];
+
+/**
+ * Collect source files under the Console UI.
+ *
+ * @param dir - Directory
+ */
+async function collectSources(dir: string): Promise<string[]> {
+  const out: string[] = [];
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === "dist" || entry.name === "node_modules") continue;
+      out.push(...(await collectSources(path)));
+      continue;
+    }
+    if (/\.(tsx?|jsx?|html|css)$/.test(entry.name)) {
+      out.push(path);
+    }
+  }
+  return out;
+}
+
+/**
+ * Scan source text for forbidden XSS sinks.
+ *
+ * @param text - Source
+ */
+export function findXssViolations(text: string): string[] {
+  return FORBIDDEN.filter((pattern) => pattern.test(text)).map(String);
+}
+
+describe("console XSS gate", () => {
+  test("scan glob covers every ui/<panel> directory that exists today", async () => {
+    const entries = await readdir(UI_ROOT, { withFileTypes: true });
+    const dirs = entries
+      .filter((e) => e.isDirectory())
+      .map((e) => e.name)
+      .filter((name) => name !== "dist" && name !== "shell" && name !== "node_modules")
+      .sort();
+    expect(dirs).toEqual([...CONSOLE_UI_PANEL_DIRS].sort());
+
+    const files = await collectSources(UI_ROOT);
+    for (const panel of CONSOLE_UI_PANEL_DIRS) {
+      const hit = files.some((f) => f.includes(`/ui/${panel}/`) || f.includes(`\\ui\\${panel}\\`));
+      expect(hit).toBe(true);
+    }
+  });
+
+  test("no dangerouslySetInnerHTML or raw HTML sinks in Console UI", async () => {
+    const files = await collectSources(UI_ROOT);
+    expect(files.length).toBeGreaterThan(0);
+    const violations: string[] = [];
+    for (const file of files) {
+      const text = await Bun.file(file).text();
+      for (const pattern of FORBIDDEN) {
+        if (pattern.test(text)) {
+          violations.push(`${file}: ${pattern}`);
+        }
+      }
+    }
+    expect(violations).toEqual([]);
+  });
+
+  test("gate fails a PR that introduces raw HTML", () => {
+    const bad = `export function Evil() { return <div dangerouslySetInnerHTML={{ __html: x }} />; }`;
+    expect(findXssViolations(bad).length).toBeGreaterThan(0);
+    expect(findXssViolations(`el.innerHTML = payload`)).toContain(
+      String(/\.innerHTML\s*=/),
+    );
+  });
+});