panopticon-cli 0.4.28 → 0.4.31

package/scripts/record-cost-event.js

@@ -1,94 +1,258 @@
 #!/usr/bin/env node
-/**
- * Record a cost event from Claude Code tool usage
- * Called by heartbeat-hook with JSON input on stdin
- */
 
-import { readFileSync } from 'fs';
-import { calculateCost, getPricing } from '../src/lib/cost.js';
-import { appendCostEvent } from '../src/lib/costs/events.js';
+// scripts/record-cost-event.ts
+import { readFileSync as readFileSync2, existsSync as existsSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, openSync, readSync, fstatSync, closeSync } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
 
-// Read tool info from stdin
-let toolInfo;
-try {
-  const input = readFileSync(0, 'utf-8');
-  toolInfo = JSON.parse(input);
-} catch (err) {
-  // Silent failure - don't break Claude Code execution
-  process.exit(0);
-}
+// src/lib/cost.ts
+import { join as join2 } from "path";
 
-// Extract usage data from tool info
-const usage = toolInfo?.usage || toolInfo?.message?.usage;
-if (!usage) {
-  // No usage data - not a Claude API call
-  process.exit(0);
+// src/lib/paths.ts
+import { homedir } from "os";
+import { join } from "path";
+import { fileURLToPath } from "url";
+import { dirname } from "path";
+var PANOPTICON_HOME = process.env.PANOPTICON_HOME || join(homedir(), ".panopticon");
+var CONFIG_DIR = PANOPTICON_HOME;
+var SKILLS_DIR = join(PANOPTICON_HOME, "skills");
+var COMMANDS_DIR = join(PANOPTICON_HOME, "commands");
+var AGENTS_DIR = join(PANOPTICON_HOME, "agents");
+var BIN_DIR = join(PANOPTICON_HOME, "bin");
+var BACKUPS_DIR = join(PANOPTICON_HOME, "backups");
+var COSTS_DIR = join(PANOPTICON_HOME, "costs");
+var HEARTBEATS_DIR = join(PANOPTICON_HOME, "heartbeats");
+var TRAEFIK_DIR = join(PANOPTICON_HOME, "traefik");
+var TRAEFIK_DYNAMIC_DIR = join(TRAEFIK_DIR, "dynamic");
+var TRAEFIK_CERTS_DIR = join(TRAEFIK_DIR, "certs");
+var CERTS_DIR = join(PANOPTICON_HOME, "certs");
+var CONFIG_FILE = join(CONFIG_DIR, "config.toml");
+var SETTINGS_FILE = join(CONFIG_DIR, "settings.json");
+var CLAUDE_DIR = join(homedir(), ".claude");
+var CODEX_DIR = join(homedir(), ".codex");
+var CURSOR_DIR = join(homedir(), ".cursor");
+var GEMINI_DIR = join(homedir(), ".gemini");
+var OPENCODE_DIR = join(homedir(), ".opencode");
+var SYNC_TARGETS = {
+  claude: {
+    skills: join(CLAUDE_DIR, "skills"),
+    commands: join(CLAUDE_DIR, "commands"),
+    agents: join(CLAUDE_DIR, "agents")
+  },
+  codex: {
+    skills: join(CODEX_DIR, "skills"),
+    commands: join(CODEX_DIR, "commands"),
+    agents: join(CODEX_DIR, "agents")
+  },
+  cursor: {
+    skills: join(CURSOR_DIR, "skills"),
+    commands: join(CURSOR_DIR, "commands"),
+    agents: join(CURSOR_DIR, "agents")
+  },
+  gemini: {
+    skills: join(GEMINI_DIR, "skills"),
+    commands: join(GEMINI_DIR, "commands"),
+    agents: join(GEMINI_DIR, "agents")
+  },
+  opencode: {
+    skills: join(OPENCODE_DIR, "skills"),
+    commands: join(OPENCODE_DIR, "commands"),
+    agents: join(OPENCODE_DIR, "agents")
+  }
+};
+var TEMPLATES_DIR = join(PANOPTICON_HOME, "templates");
+var CLAUDE_MD_TEMPLATES = join(TEMPLATES_DIR, "claude-md", "sections");
+var currentFile = fileURLToPath(import.meta.url);
+var currentDir = dirname(currentFile);
+var packageRoot;
+if (currentDir.includes("/src/")) {
+  packageRoot = dirname(dirname(currentDir));
+} else {
+  packageRoot = currentDir.endsWith("/lib") ? dirname(dirname(currentDir)) : dirname(currentDir);
 }
+var SOURCE_TEMPLATES_DIR = join(packageRoot, "templates");
+var SOURCE_TRAEFIK_TEMPLATES = join(SOURCE_TEMPLATES_DIR, "traefik");
+var SOURCE_SCRIPTS_DIR = join(packageRoot, "scripts");
+var SOURCE_SKILLS_DIR = join(packageRoot, "skills");
+var SOURCE_DEV_SKILLS_DIR = join(packageRoot, "dev-skills");
 
-// Extract token counts
-const inputTokens = usage.input_tokens || 0;
-const outputTokens = usage.output_tokens || 0;
-const cacheReadTokens = usage.cache_read_input_tokens || 0;
-const cacheWriteTokens = usage.cache_creation_input_tokens || 0;
-
-// Must have at least some tokens to record
-if (inputTokens === 0 && outputTokens === 0 && cacheReadTokens === 0 && cacheWriteTokens === 0) {
-  process.exit(0);
+// src/lib/cost.ts
+var DEFAULT_PRICING = [
+  // Anthropic - 4.6 series
+  { provider: "anthropic", model: "claude-opus-4.6", inputPer1k: 5e-3, outputPer1k: 0.025, cacheReadPer1k: 5e-4, cacheWrite5mPer1k: 625e-5, cacheWrite1hPer1k: 0.01, currency: "USD" },
+  { provider: "anthropic", model: "claude-sonnet-4.5", inputPer1k: 3e-3, outputPer1k: 0.015, cacheReadPer1k: 3e-4, cacheWrite5mPer1k: 375e-5, cacheWrite1hPer1k: 6e-3, currency: "USD" },
+  { provider: "anthropic", model: "claude-haiku-4.5", inputPer1k: 1e-3, outputPer1k: 5e-3, cacheReadPer1k: 1e-4, cacheWrite5mPer1k: 125e-5, cacheWrite1hPer1k: 2e-3, currency: "USD" },
+  // Anthropic - 4.x series
+  { provider: "anthropic", model: "claude-opus-4-1", inputPer1k: 0.015, outputPer1k: 0.075, cacheReadPer1k: 15e-4, cacheWrite5mPer1k: 0.01875, cacheWrite1hPer1k: 0.03, currency: "USD" },
+  { provider: "anthropic", model: "claude-opus-4", inputPer1k: 0.015, outputPer1k: 0.075, cacheReadPer1k: 15e-4, cacheWrite5mPer1k: 0.01875, cacheWrite1hPer1k: 0.03, currency: "USD" },
+  { provider: "anthropic", model: "claude-sonnet-4", inputPer1k: 3e-3, outputPer1k: 0.015, cacheReadPer1k: 3e-4, cacheWrite5mPer1k: 375e-5, cacheWrite1hPer1k: 6e-3, currency: "USD" },
+  // Anthropic - Legacy
+  { provider: "anthropic", model: "claude-haiku-3", inputPer1k: 25e-5, outputPer1k: 125e-5, cacheReadPer1k: 3e-5, cacheWrite5mPer1k: 3e-4, cacheWrite1hPer1k: 5e-4, currency: "USD" },
+  // OpenAI
+  { provider: "openai", model: "gpt-4-turbo", inputPer1k: 0.01, outputPer1k: 0.03, currency: "USD" },
+  { provider: "openai", model: "gpt-4o", inputPer1k: 5e-3, outputPer1k: 0.015, currency: "USD" },
+  { provider: "openai", model: "gpt-4o-mini", inputPer1k: 15e-5, outputPer1k: 6e-4, currency: "USD" },
+  // Google
+  { provider: "google", model: "gemini-1.5-pro", inputPer1k: 125e-5, outputPer1k: 5e-3, currency: "USD" },
+  { provider: "google", model: "gemini-1.5-flash", inputPer1k: 75e-6, outputPer1k: 3e-4, currency: "USD" },
+  // Moonshot AI (Kimi)
+  { provider: "custom", model: "kimi-for-coding", inputPer1k: 6e-4, outputPer1k: 2e-3, cacheReadPer1k: 6e-5, cacheWrite5mPer1k: 75e-5, currency: "USD" },
+  { provider: "custom", model: "kimi-k2.5", inputPer1k: 6e-4, outputPer1k: 2e-3, cacheReadPer1k: 6e-5, cacheWrite5mPer1k: 75e-5, currency: "USD" }
+];
+function calculateCost(usage, pricing) {
+  let cost = 0;
+  let inputMultiplier = 1;
+  let outputMultiplier = 1;
+  const totalInputTokens = usage.inputTokens + (usage.cacheReadTokens || 0) + (usage.cacheWriteTokens || 0);
+  if ((pricing.model === "claude-sonnet-4" || pricing.model === "claude-sonnet-4.5") && totalInputTokens > 2e5) {
+    inputMultiplier = 2;
+    outputMultiplier = 1.5;
+  }
+  cost += usage.inputTokens / 1e3 * pricing.inputPer1k * inputMultiplier;
+  cost += usage.outputTokens / 1e3 * pricing.outputPer1k * outputMultiplier;
+  if (usage.cacheReadTokens && pricing.cacheReadPer1k) {
+    cost += usage.cacheReadTokens / 1e3 * pricing.cacheReadPer1k;
+  }
+  if (usage.cacheWriteTokens) {
+    const ttl = usage.cacheTTL || "5m";
+    const cacheWritePrice = ttl === "1h" ? pricing.cacheWrite1hPer1k : pricing.cacheWrite5mPer1k;
+    if (cacheWritePrice) {
+      cost += usage.cacheWriteTokens / 1e3 * cacheWritePrice;
+    }
+  }
+  return Math.round(cost * 1e6) / 1e6;
 }
+function getPricing(provider, model) {
+  let pricing = DEFAULT_PRICING.find(
+    (p) => p.provider === provider && p.model === model
+  );
+  if (!pricing) {
+    pricing = DEFAULT_PRICING.find(
+      (p) => p.provider === provider && model.startsWith(p.model)
+    );
+  }
+  return pricing || null;
+}
+var BUDGETS_FILE = join2(COSTS_DIR, "budgets.json");
 
-// Extract model name
-const model = toolInfo?.model || toolInfo?.message?.model || 'claude-sonnet-4';
-
-// Determine provider from model name
-let provider = 'anthropic';
-if (model.includes('gpt')) {
-  provider = 'openai';
-} else if (model.includes('gemini')) {
-  provider = 'google';
+// src/lib/costs/events.ts
+import { existsSync, mkdirSync, readFileSync, appendFileSync, writeFileSync, renameSync } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+function getCostsDir() {
+  return join3(process.env.HOME || homedir2(), ".panopticon", "costs");
+}
+function getEventsFile() {
+  return join3(getCostsDir(), "events.jsonl");
+}
+function ensureEventsFile() {
+  const costsDir = getCostsDir();
+  const eventsFile = getEventsFile();
+  mkdirSync(costsDir, { recursive: true });
+  if (!existsSync(eventsFile)) {
+    writeFileSync(eventsFile, "", "utf-8");
+  }
+}
+function appendCostEvent(event2) {
+  ensureEventsFile();
+  if (!event2.ts || !event2.agentId || !event2.issueId || !event2.model) {
+    throw new Error("Missing required event fields: ts, agentId, issueId, model");
+  }
+  const line = JSON.stringify(event2) + "\n";
+  appendFileSync(getEventsFile(), line, "utf-8");
 }
 
-// Get pricing and calculate cost
-const pricing = getPricing(provider, model);
-if (!pricing) {
-  console.warn(`No pricing found for ${provider}/${model}`);
+// scripts/record-cost-event.ts
+var event;
+try {
+  const input = readFileSync2(0, "utf-8");
+  event = JSON.parse(input);
+} catch {
   process.exit(0);
 }
-
-const cost = calculateCost({
-  inputTokens,
-  outputTokens,
-  cacheReadTokens,
-  cacheWriteTokens,
-  cacheTTL: '5m',
-}, pricing);
-
-// Get agent and issue context from environment
-// PANOPTICON_AGENT_ID should always be set by pan work or heartbeat-hook
-// If not set, use a fallback that makes it clear costs are unattributed
-const agentId = process.env.PANOPTICON_AGENT_ID || 'unattributed';
-
-const issueId = process.env.PANOPTICON_ISSUE_ID || 'UNKNOWN';
-const sessionType = process.env.PANOPTICON_SESSION_TYPE || 'implementation';
-
-// Record cost event
+var transcriptPath = event?.transcript_path;
+if (!transcriptPath || !existsSync2(transcriptPath)) {
+  process.exit(0);
+}
+var sessionId = event?.session_id || "unknown";
+var stateDir = join4(process.env.HOME || homedir3(), ".panopticon", "costs", "state");
+mkdirSync2(stateDir, { recursive: true });
+var stateFile = join4(stateDir, `${sessionId}.offset`);
+var lastOffset = 0;
+if (existsSync2(stateFile)) {
+  try {
+    lastOffset = parseInt(readFileSync2(stateFile, "utf-8").trim(), 10) || 0;
+  } catch {
+  }
+}
+var fd;
 try {
-  appendCostEvent({
-    ts: new Date().toISOString(),
-    type: 'cost',
-    agentId,
-    issueId,
-    sessionType,
-    provider,
-    model,
-    input: inputTokens,
-    output: outputTokens,
-    cacheRead: cacheReadTokens,
-    cacheWrite: cacheWriteTokens,
-    cost,
-  });
-} catch (err) {
-  // Silent failure - don't break Claude Code execution
-  console.error('Failed to record cost event:', err);
+  fd = openSync(transcriptPath, "r");
+} catch {
+  process.exit(0);
 }
-
+var stat = fstatSync(fd);
+if (stat.size <= lastOffset) {
+  closeSync(fd);
+  writeFileSync2(stateFile, String(stat.size), "utf-8");
+  process.exit(0);
+}
+var bytesToRead = stat.size - lastOffset;
+var buffer = Buffer.alloc(bytesToRead);
+readSync(fd, buffer, 0, bytesToRead, lastOffset);
+closeSync(fd);
+var newContent = buffer.toString("utf-8");
+var lines = newContent.split("\n");
+var agentId = process.env.PANOPTICON_AGENT_ID || "unattributed";
+var issueId = process.env.PANOPTICON_ISSUE_ID || "UNKNOWN";
+var sessionType = process.env.PANOPTICON_SESSION_TYPE || "implementation";
+for (const line of lines) {
+  if (!line.trim()) continue;
+  try {
+    const entry = JSON.parse(line);
+    if (entry.type !== "assistant" || !entry.message?.usage) {
+      continue;
+    }
+    const usage = entry.message.usage;
+    const model = entry.message.model || "claude-sonnet-4";
+    const inputTokens = usage.input_tokens || 0;
+    const outputTokens = usage.output_tokens || 0;
+    const cacheReadTokens = usage.cache_read_input_tokens || 0;
+    const cacheWriteTokens = usage.cache_creation_input_tokens || 0;
+    if (inputTokens === 0 && outputTokens === 0 && cacheReadTokens === 0 && cacheWriteTokens === 0) {
+      continue;
+    }
+    let provider = "anthropic";
+    if (model.includes("gpt")) {
+      provider = "openai";
+    } else if (model.includes("gemini")) {
+      provider = "google";
+    }
+    const pricing = getPricing(provider, model);
+    if (!pricing) continue;
+    const cost = calculateCost({
+      inputTokens,
+      outputTokens,
+      cacheReadTokens,
+      cacheWriteTokens,
+      cacheTTL: "5m"
+    }, pricing);
+    appendCostEvent({
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      type: "cost",
+      agentId,
+      issueId,
+      sessionType,
+      provider,
+      model,
+      input: inputTokens,
+      output: outputTokens,
+      cacheRead: cacheReadTokens,
+      cacheWrite: cacheWriteTokens,
+      cost
+    });
+  } catch {
+  }
+}
+writeFileSync2(stateFile, String(stat.size), "utf-8");
 process.exit(0);

package/scripts/record-cost-event.ts

@@ -1,113 +1,173 @@
 #!/usr/bin/env node
 /**
- * Record a cost event from Claude Code tool usage
- * Called by heartbeat-hook with JSON input on stdin
+ * Record cost events from Claude Code transcript data
+ * Called by heartbeat-hook with PostToolUse JSON on stdin
+ *
+ * Claude Code's PostToolUse events do NOT include token usage.
+ * Instead, we read usage from the transcript JSONL file
+ * (available via the transcript_path field in the event).
+ *
+ * Uses byte-offset tracking to efficiently process only new
+ * transcript entries on each invocation.
  */
 
-import { readFileSync } from 'fs';
+import { readFileSync, existsSync, writeFileSync, mkdirSync, openSync, readSync, fstatSync, closeSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
 import { calculateCost, getPricing, AIProvider } from '../src/lib/cost.js';
 import { appendCostEvent } from '../src/lib/costs/events.js';
 
 // ============== Types ==============
 
-interface UsageData {
+interface PostToolUseEvent {
+  session_id?: string;
+  transcript_path?: string;
+  tool_name?: string;
+  tool_use_id?: string;
+}
+
+interface TranscriptUsage {
   input_tokens?: number;
   output_tokens?: number;
   cache_read_input_tokens?: number;
   cache_creation_input_tokens?: number;
 }
 
-interface ToolInfo {
-  model?: string;
-  usage?: UsageData;
+interface TranscriptEntry {
+  type?: string;
   message?: {
     model?: string;
-    usage?: UsageData;
+    usage?: TranscriptUsage;
   };
+  requestId?: string;
 }
 
 // ============== Main ==============
 
-// Read tool info from stdin
-let toolInfo: ToolInfo;
+// Read PostToolUse event from stdin
+let event: PostToolUseEvent;
 try {
   const input = readFileSync(0, 'utf-8');
-  toolInfo = JSON.parse(input) as ToolInfo;
-} catch (err) {
-  // Silent failure - don't break Claude Code execution
+  event = JSON.parse(input) as PostToolUseEvent;
+} catch {
   process.exit(0);
 }
 
-// Extract usage data from tool info
-const usage: UsageData | undefined = toolInfo?.usage || toolInfo?.message?.usage;
-if (!usage) {
-  // No usage data - not a Claude API call
+// Need transcript path to read usage data
+const transcriptPath = event?.transcript_path;
+if (!transcriptPath || !existsSync(transcriptPath)) {
   process.exit(0);
 }
 
-// Extract token counts
-const inputTokens = usage.input_tokens || 0;
-const outputTokens = usage.output_tokens || 0;
-const cacheReadTokens = usage.cache_read_input_tokens || 0;
-const cacheWriteTokens = usage.cache_creation_input_tokens || 0;
+const sessionId = event?.session_id || 'unknown';
 
-// Must have at least some tokens to record
-if (inputTokens === 0 && outputTokens === 0 && cacheReadTokens === 0 && cacheWriteTokens === 0) {
-  process.exit(0);
-}
+// State tracking: byte offset per session to avoid re-processing
+const stateDir = join(process.env.HOME || homedir(), '.panopticon', 'costs', 'state');
+mkdirSync(stateDir, { recursive: true });
+const stateFile = join(stateDir, `${sessionId}.offset`);
 
-// Extract model name
-const model: string = toolInfo?.model || toolInfo?.message?.model || 'claude-sonnet-4';
+let lastOffset = 0;
+if (existsSync(stateFile)) {
+  try {
+    lastOffset = parseInt(readFileSync(stateFile, 'utf-8').trim(), 10) || 0;
+  } catch { /* start from 0 */ }
+}
 
-// Determine provider from model name
-let provider: AIProvider = 'anthropic';
-if (model.includes('gpt')) {
-  provider = 'openai';
-} else if (model.includes('gemini')) {
-  provider = 'google';
+// Read only NEW content from the transcript (efficient for large files)
+let fd: number;
+try {
+  fd = openSync(transcriptPath, 'r');
+} catch {
+  process.exit(0);
 }
 
-// Get pricing and calculate cost
-const pricing = getPricing(provider, model);
-if (!pricing) {
-  console.warn(`No pricing found for ${provider}/${model}`);
+const stat = fstatSync(fd);
+if (stat.size <= lastOffset) {
+  closeSync(fd);
+  // Save current size even if no new content (handles file truncation)
+  writeFileSync(stateFile, String(stat.size), 'utf-8');
   process.exit(0);
 }
 
-const cost = calculateCost({
-  inputTokens,
-  outputTokens,
-  cacheReadTokens,
-  cacheWriteTokens,
-  cacheTTL: '5m',
-}, pricing);
-
-// Get agent and issue context from environment
-// PANOPTICON_AGENT_ID should always be set by pan work or heartbeat-hook
-// If not set, use a fallback that makes it clear costs are unattributed
+const bytesToRead = stat.size - lastOffset;
+const buffer = Buffer.alloc(bytesToRead);
+readSync(fd, buffer, 0, bytesToRead, lastOffset);
+closeSync(fd);
+
+const newContent = buffer.toString('utf-8');
+const lines = newContent.split('\n');
+
+// Get agent/issue context from environment
 const agentId: string = process.env.PANOPTICON_AGENT_ID || 'unattributed';
 const issueId: string = process.env.PANOPTICON_ISSUE_ID || 'UNKNOWN';
 const sessionType: string = process.env.PANOPTICON_SESSION_TYPE || 'implementation';
 
-// Record cost event
-try {
-  appendCostEvent({
-    ts: new Date().toISOString(),
-    type: 'cost',
-    agentId,
-    issueId,
-    sessionType,
-    provider,
-    model,
-    input: inputTokens,
-    output: outputTokens,
-    cacheRead: cacheReadTokens,
-    cacheWrite: cacheWriteTokens,
-    cost,
-  });
-} catch (err) {
-  // Silent failure - don't break Claude Code execution
-  console.error('Failed to record cost event:', err);
+// Process new transcript lines looking for assistant messages with usage
+for (const line of lines) {
+  if (!line.trim()) continue;
+
+  try {
+    const entry = JSON.parse(line) as TranscriptEntry;
+
+    // Only process assistant messages that have usage data
+    if (entry.type !== 'assistant' || !entry.message?.usage) {
+      continue;
+    }
+
+    const usage = entry.message.usage;
+    const model: string = entry.message.model || 'claude-sonnet-4';
+
+    const inputTokens = usage.input_tokens || 0;
+    const outputTokens = usage.output_tokens || 0;
+    const cacheReadTokens = usage.cache_read_input_tokens || 0;
+    const cacheWriteTokens = usage.cache_creation_input_tokens || 0;
+
+    // Skip entries with zero tokens
+    if (inputTokens === 0 && outputTokens === 0 && cacheReadTokens === 0 && cacheWriteTokens === 0) {
+      continue;
+    }
+
+    // Determine provider from model name
+    let provider: AIProvider = 'anthropic';
+    if (model.includes('gpt')) {
+      provider = 'openai';
+    } else if (model.includes('gemini')) {
+      provider = 'google';
+    }
+
+    // Get pricing and calculate cost
+    const pricing = getPricing(provider, model);
+    if (!pricing) continue;
+
+    const cost = calculateCost({
+      inputTokens,
+      outputTokens,
+      cacheReadTokens,
+      cacheWriteTokens,
+      cacheTTL: '5m',
+    }, pricing);
+
+    // Record the cost event
+    appendCostEvent({
+      ts: new Date().toISOString(),
+      type: 'cost',
+      agentId,
+      issueId,
+      sessionType,
+      provider,
+      model,
+      input: inputTokens,
+      output: outputTokens,
+      cacheRead: cacheReadTokens,
+      cacheWrite: cacheWriteTokens,
+      cost,
+    });
+  } catch {
+    // Skip malformed lines silently
+  }
 }
 
+// Save new byte offset for next invocation
+writeFileSync(stateFile, String(stat.size), 'utf-8');
+
 process.exit(0);

package/templates/traefik/docker-compose.yml

@@ -1,12 +1,12 @@
 services:
   traefik:
-    image: traefik:v3.0
+    image: traefik:latest
     container_name: panopticon-traefik
     restart: unless-stopped
     ports:
-      - "8081:80"     # HTTP (redirects to HTTPS)
-      - "8443:443"    # HTTPS
-      - "8082:8080"   # Traefik Dashboard
+      - "80:80"       # HTTP (redirects to HTTPS)
+      - "443:443"     # HTTPS
+      - "8080:8080"   # Traefik Dashboard
     volumes:
       # Traefik configuration
       - ./traefik.yml:/etc/traefik/traefik.yml:ro
@@ -30,6 +30,9 @@ services:
       - "traefik.http.routers.traefik-dashboard.tls=true"
       - "traefik.http.routers.traefik-dashboard.service=api@internal"
 
+    environment:
+      - DOCKER_API_VERSION=1.44
+
     extra_hosts:
       # Allow Traefik to reach host services (dashboard on configured ports)
       - "host.docker.internal:host-gateway"

package/templates/traefik/dynamic/panopticon.yml.template

@@ -25,10 +25,12 @@ http:
       tls: {}
 
   services:
+    # Both frontend and API are served by the same Express server on the API port.
+    # The bundled dashboard serves static files alongside the API.
     panopticon-frontend:
       loadBalancer:
         servers:
-          - url: "http://host.docker.internal:{{DASHBOARD_PORT}}"
+          - url: "http://host.docker.internal:{{DASHBOARD_API_PORT}}"
 
     panopticon-api:
       loadBalancer: