pi-mega-compact 0.7.8 → 0.8.0

package/dist/extensions/dashboard-server/server.js

@@ -0,0 +1,530 @@
+/**
+ * dashboard-server/server.ts — HTTP server creation + launch + CLI entry point.
+ */
+import { createServer } from "node:http";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, watch, writeFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+import { log, setLogPath, setDashboardServerVersion } from "./state.js";
+import { readIndex, getIndexDir } from "./index-reader.js";
+import { readSnapshot, readFrom } from "./snapshot.js";
+import { dashboardHtml } from "./html.js";
+import { ACTIVE_WINDOW_SEC } from "./types.js";
+export async function launchDashboardServer(stateDir) {
+    // Our own package version — exposed at /api/version so the launcher can
+    // detect a stale server (started by an older build) and replace it on
+    // upgrade instead of reuse it.
+    let SERVER_VERSION = "0.0.0";
+    try {
+        // dashboard-server.js lives at <pkg>/dist/extensions/, so package.json is
+        // two levels up. Guard each candidate so a dev-checkout layout still works.
+        const here = dirname(fileURLToPath(import.meta.url));
+        const candidates = [join(here, "..", "..", "package.json"), join(here, "..", "package.json")];
+        for (const p of candidates) {
+            if (!existsSync(p))
+                continue;
+            const pkg = JSON.parse(readFileSync(p, "utf-8"));
+            if (pkg.version) {
+                SERVER_VERSION = pkg.version;
+                setDashboardServerVersion(pkg.version);
+                break;
+            }
+        }
+    }
+    catch { /* non-fatal */ }
+    // Lazy-loaded via require so the dashboard stays cheap to boot and we don't
+    // need a top-level await in the handler.
+    const driftReq = createRequire(import.meta.url);
+    const detectCrossRepoDrift = (idxDir) => driftReq("../../src/driftDetection.js")
+        .detectCrossRepoDrift(idxDir);
+    const portFile = join(stateDir, "port.pid");
+    const snapshotPath = join(stateDir, "dashboard.json");
+    const eventsPath = join(stateDir, "events.log");
+    setLogPath(join(stateDir, "dashboard.log"));
+    log("launch invoked", { stateDir });
+    // ── Existing server? ───────────────────────────────────────────────────────
+    // A stale port.pid pointing at a dead/competing process is the classic cause
+    // of "dashboard failed to start" — we return a port that is NOT actually
+    // serving. Probe for a live server on that port first; only reuse the marker
+    // when something real answers /api/version. Otherwise drop it and start fresh.
+    if (existsSync(portFile)) {
+        try {
+            const info = JSON.parse(readFileSync(portFile, "utf-8"));
+            if (info && info.port) {
+                let live = false;
+                try {
+                    const probe = await fetch(`http://localhost:${info.port}/api/version`, { signal: AbortSignal.timeout(800) }); // guardrails-allow PREVENT-PI-004: optional localhost dashboard server probe (loopback-only)
+                    live = probe.ok;
+                }
+                catch {
+                    live = false;
+                }
+                if (live) {
+                    log("reusing live server from port.pid", { port: info.port });
+                    return { port: info.port, url: `http://localhost:${info.port}` }; // guardrails-allow PREVENT-PI-004: localhost dashboard URL (loopback-only)
+                }
+                log("port.pid present but no live server — treating as stale", { port: info.port });
+            }
+        }
+        catch {
+            log("port.pid unparseable — treating as stale");
+        }
+        // stale file, remove so the fresh bind does not collide with a lingering
+        // process that still holds the port
+        try {
+            unlinkSync(portFile);
+        }
+        catch { /* ignore */ }
+    }
+    // ── New server ────────────────────────────────────────────────────────────
+    mkdirSync(stateDir, { recursive: true });
+    let eventOffset = 0;
+    // Overlay the live current-repo snapshot (snapshot.json, rewritten every
+    // context event) onto its registry row so the All-repos / Summary views stay
+    // in sync with the live menu bar + Current-repo card in real time. The
+    // registry (index.sqlite) is only written on repo-switch (bindRepo), so
+    // without this the current repo's row freezes between switches. Read-only —
+    // no extra writes to index.sqlite. Matched by stateDir, which equals the
+    // value this server was launched with (runtime.currentStateDir).
+    function overlayCurrentRepo(idx) {
+        if (!idx || !idx.repos.length)
+            return;
+        let snap = null;
+        try {
+            snap = readSnapshot(snapshotPath);
+        }
+        catch {
+            return;
+        }
+        if (!snap || !snap.repo)
+            return;
+        const cur = idx.repos.find((r) => r.stateDir === stateDir);
+        if (!cur)
+            return;
+        const prevSaved = cur.tokensSaved;
+        const prevCp = cur.checkpointCount;
+        const prevBytes = cur.compressedOriginalBytes;
+        const comp = snap.compression?.repo;
+        const liveSaved = comp ? comp.tokensFreed : (snap.repo.tokensSaved ?? prevSaved);
+        const liveCp = snap.repo.checkpointCount ?? prevCp;
+        const liveBytes = snap.integrity?.compressedOriginalBytes ?? prevBytes;
+        cur.tokensSaved = liveSaved;
+        cur.checkpointCount = liveCp;
+        cur.compressedOriginalBytes = liveBytes;
+        if (idx.summary) {
+            idx.summary.totalTokensSaved += liveSaved - prevSaved;
+            idx.summary.totalCheckpoints += liveCp - prevCp;
+            idx.summary.totalCompressedOriginalBytes += liveBytes - prevBytes;
+        }
+        idx.updatedAt = snap.updatedAt ?? idx.updatedAt;
+    }
+    const server = createServer((req, res) => {
+        // guardrails-allow PREVENT-PI-004: optional, user-triggered /dashboard localhost server (loopback-only) — CORS open for local browser access
+        // CORS for local access
+        res.setHeader("Access-Control-Allow-Origin", "*");
+        res.setHeader("Access-Control-Allow-Methods", "GET, PUT, OPTIONS");
+        res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+        if (req.method === "OPTIONS") {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        if (req.url === "/" || req.url === "/index.html") {
+            const tier = readSnapshot(snapshotPath).tier;
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(dashboardHtml(tier));
+            return;
+        }
+        if (req.url === "/api/snapshot") {
+            const snap = readSnapshot(snapshotPath);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(snap));
+            return;
+        }
+        // Server version — lets the /dashboard launcher detect a stale server from
+        // an older build and replace it on upgrade rather than reuse it.
+        if (req.url === "/api/version") {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ version: SERVER_VERSION }));
+            return;
+        }
+        // Multi-repo aggregate (Phase 5b): the machine-wide repo registry read
+        // directly from SQLite (index.sqlite). Lets one dashboard show every repo's
+        // checkpoints, tokens saved, and active model. Read-only.
+        if (req.url === "/api/index") {
+            const idx = readIndex();
+            if (idx)
+                overlayCurrentRepo(idx);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(idx ?? { updatedAt: null, summary: null, repos: [] }));
+            return;
+        }
+        // /api/repos — registry list. Optional `?active=24h` filters to repos
+        // seen within the last N hours (default: all). The dashboard uses this to
+        // drive its "active vs archived" badge without refetching /api/index.
+        if (req.url?.startsWith("/api/repos")) {
+            const url = new URL(req.url, "http://x"); // guardrails-allow PREVENT-PI-004: localhost dashboard URL base (loopback-only)
+            const activeParam = url.searchParams.get("active");
+            const idx = readIndex();
+            if (idx)
+                overlayCurrentRepo(idx);
+            let repos = idx?.repos ?? [];
+            if (activeParam) {
+                const m = /^(\d+)h$/.exec(activeParam);
+                if (m) {
+                    const cutoffSec = Math.floor(Date.now() / 1000) - Number(m[1]) * 3600;
+                    repos = repos.filter((r) => (r.lastSeen ?? 0) >= cutoffSec);
+                }
+            }
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ updatedAt: idx?.updatedAt ?? null, repos, count: repos.length }));
+            return;
+        }
+        // /api/summary — header tiles without the full repo list (keeps payload
+        // small for embed scenarios). activeRepos mirrors the /api/repos?active=24h
+        // count so the dashboard can render the active badge alongside totals.
+        if (req.url?.startsWith("/api/summary")) {
+            const idx = readIndex();
+            if (idx)
+                overlayCurrentRepo(idx);
+            const repos = idx?.repos ?? [];
+            const cutoffSec = Math.floor(Date.now() / 1000) - 24 * 3600;
+            const activeRepos = repos.filter((r) => (r.lastSeen ?? 0) >= cutoffSec).length;
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                updatedAt: idx?.updatedAt ?? null,
+                summary: idx?.summary ?? null,
+                activeRepos,
+                totalRepos: repos.length,
+            }));
+            return;
+        }
+        // /api/drift — R4: cross-repo drift report over repo_registry. Flags stale
+        // repos (>30d idle), compaction lag (active but >24h since last
+        // compaction), and recent model churn. Read-only.
+        if (req.url?.startsWith("/api/drift")) {
+            const report = detectCrossRepoDrift(getIndexDir());
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(report));
+            return;
+        }
+        if (req.url === "/api/servers") {
+            try {
+                const idx = readIndex();
+                const nowSec = Math.floor(Date.now() / 1000);
+                const servers = (idx?.repos ?? []).filter((r) => (r.lastSeen ?? 0) >= nowSec - ACTIVE_WINDOW_SEC).map((r) => {
+                    const out = { repoRoot: r.repoRoot, displayName: r.displayName, model: r.modelName, provider: r.providerName, lastSeen: r.lastSeen, lastCompactedAt: r.lastCompactedAt };
+                    try {
+                        const p = join(r.stateDir, "dashboard.json");
+                        if (existsSync(p)) {
+                            const snap = JSON.parse(readFileSync(p, "utf-8"));
+                            out.tier = snap.tier ?? null;
+                            out.contextPct = (snap.context && snap.context.percent != null) ? snap.context.percent : null;
+                            out.state = (snap.session && snap.session.state) || null;
+                            out.cacheHits = snap.cacheHits ?? null;
+                            out.compacts = snap.compacts ?? null;
+                            out.timeSaved = snap.timeSaved ?? null;
+                            out.updatedAt = snap.updatedAt ?? null;
+                        }
+                    }
+                    catch { /* best-effort */ }
+                    return out;
+                }).sort((a, b) => b.lastSeen - a.lastSeen);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ updatedAt: new Date().toISOString(), servers }));
+            }
+            catch {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "servers_unavailable" }));
+            }
+            return;
+        }
+        if (req.url === "/api/events") {
+            res.writeHead(200, {
+                "Content-Type": "text/event-stream",
+                "Cache-Control": "no-cache",
+                "Connection": "keep-alive",
+            });
+            // Drain existing events so the client starts with history
+            const { data: existing, offset: initialOffset } = readFrom(eventsPath, 0);
+            eventOffset = initialOffset;
+            const lines = existing.split("\n").filter((l) => l.trim());
+            for (const line of lines) {
+                res.write(`data: ${line}\n\n`);
+            }
+            // Tail new events via fs.watch (coalesced with 100ms debounce)
+            let watchTimer = null;
+            const onWatch = () => {
+                if (watchTimer)
+                    return;
+                watchTimer = setTimeout(() => {
+                    watchTimer = null;
+                    const { data, offset } = readFrom(eventsPath, eventOffset);
+                    eventOffset = offset;
+                    const newLines = data.split("\n").filter((l) => l.trim());
+                    for (const line of newLines) {
+                        res.write(`data: ${line}\n\n`);
+                    }
+                }, 100);
+            };
+            // Set up file watching: if file exists, watch it directly;
+            // otherwise poll for creation every 1s then switch to fs.watch.
+            let watcher = null;
+            let pollInterval = null;
+            function startFileWatch() {
+                try {
+                    watcher = watch(eventsPath, onWatch);
+                }
+                catch { /* give up */ }
+            }
+            if (existsSync(eventsPath)) {
+                startFileWatch();
+            }
+            else {
+                pollInterval = setInterval(() => {
+                    if (existsSync(eventsPath)) {
+                        if (pollInterval) {
+                            clearInterval(pollInterval);
+                            pollInterval = null;
+                        }
+                        startFileWatch();
+                    }
+                }, 1000);
+            }
+            req.on("close", () => {
+                if (watchTimer)
+                    clearTimeout(watchTimer);
+                if (pollInterval)
+                    clearInterval(pollInterval);
+                watcher?.close();
+            });
+            return;
+        }
+        // /api/game-state — S32 game-mode settings (game_mode_on / theme /
+        // tui_display_mode). GET returns the current row; PUT applies a partial
+        // patch (validated) and returns the post-write row. The dashboard server is
+        // a detached child with no MegaRuntime ref, so it reads/writes the
+        // game_state SQLite row directly; the in-process MegaRuntime picks up the
+        // change via its fs.watch cache-eviction watcher. PREVENT-PI-004: loopback.
+        if (req.url?.startsWith("/api/game-state")) {
+            const gsReq = createRequire(import.meta.url);
+            const { getGameState, setGameState } = gsReq("../../src/store/sqlite.js");
+            const { isValidTheme } = gsReq("../../src/config/themes.js");
+            if (req.method === "GET") {
+                try {
+                    const gs = getGameState(stateDir); // guardrails-allow PREVENT-PI-004: local SQLite read (loopback dashboard)
+                    res.writeHead(200, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify(gs));
+                }
+                catch (e) {
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "game_state_unavailable", detail: String(e) }));
+                }
+                return;
+            }
+            if (req.method === "PUT") {
+                // Read + parse the JSON body (capped — the patch is tiny). The handler
+                // is sync, so drain the stream via data/end listeners then continue.
+                let body = "";
+                let tooBig = false;
+                req.on("data", (chunk) => {
+                    if (body.length > 65536) {
+                        tooBig = true;
+                        return;
+                    }
+                    body += chunk.toString();
+                });
+                req.on("end", () => {
+                    if (tooBig) {
+                        res.writeHead(413, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ error: "body_too_large" }));
+                        return;
+                    }
+                    let patch = {};
+                    try {
+                        patch = body ? JSON.parse(body) : {};
+                    }
+                    catch {
+                        res.writeHead(400, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ error: "invalid_json" }));
+                        return;
+                    }
+                    // Reject valid-but-non-object JSON (null/[]/42) — dereferencing
+                    // patch.game_mode_on would throw an unhandled TypeError inside this
+                    // 'end' listener and crash the detached server (audit P1: loopback DoS).
+                    if (typeof patch !== "object" || patch === null || Array.isArray(patch)) {
+                        res.writeHead(400, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ error: "invalid_patch_object" }));
+                        return;
+                    }
+                    // Validate the patch fields (unknown keys ignored; invalid values -> 400).
+                    const clean = {};
+                    let bad = false;
+                    if (patch.game_mode_on != null) {
+                        if (typeof patch.game_mode_on !== "boolean")
+                            bad = true;
+                        else
+                            clean.game_mode_on = patch.game_mode_on;
+                    }
+                    if (patch.theme != null) {
+                        if (typeof patch.theme !== "string" || !isValidTheme(patch.theme))
+                            bad = true;
+                        else
+                            clean.theme = patch.theme;
+                    }
+                    if (patch.tui_display_mode != null) {
+                        if (patch.tui_display_mode !== "full" && patch.tui_display_mode !== "minimal")
+                            bad = true;
+                        else
+                            clean.tui_display_mode = patch.tui_display_mode;
+                    }
+                    if (bad) {
+                        res.writeHead(400, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ error: "invalid_patch" }));
+                        return;
+                    }
+                    try {
+                        const gs = setGameState(clean, stateDir); // guardrails-allow PREVENT-PI-004: local SQLite write (loopback dashboard)
+                        res.writeHead(200, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify(gs));
+                    }
+                    catch (e) {
+                        res.writeHead(500, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ error: "game_state_write_failed", detail: String(e) }));
+                    }
+                });
+                return;
+            }
+            // Any other method on /api/game-state → 405.
+            res.writeHead(405, { "Content-Type": "application/json" }); // guardrails-allow PREVENT-PI-004: loopback dashboard response (local)
+            res.end(JSON.stringify({ error: "method_not_allowed" }));
+            return;
+        }
+        // /api/game-scores — S34 high-score leaderboards. GET returns the leaderboard
+        // for a metric (?metric=<m>&limit=<n>). `metric` is validated against the
+        // METRICS allow-list from src/game/scoring (re-exported via the sqlite barrel);
+        // default limit 10, clamped to [1,100]. The dashboard server is a detached
+        // child with no MegaRuntime ref, so it reads the game_scores SQLite table
+        // directly. Unknown metric -> 400, non-GET -> 405. PREVENT-PI-004: loopback.
+        if (req.url?.startsWith("/api/game-scores")) {
+            const gsReq = createRequire(import.meta.url);
+            const { leaderboard, METRICS } = gsReq("../../src/store/sqlite.js");
+            if (req.method !== "GET") {
+                res.writeHead(405, { "Content-Type": "application/json" }); // guardrails-allow PREVENT-PI-004: loopback dashboard response (local)
+                res.end(JSON.stringify({ error: "method_not_allowed" }));
+                return;
+            }
+            try {
+                const url = new URL(req.url, "http://x"); // guardrails-allow PREVENT-PI-004: localhost dashboard URL base (loopback-only)
+                const metricParam = url.searchParams.get("metric") ?? "cache";
+                if (!METRICS.includes(metricParam)) {
+                    res.writeHead(400, { "Content-Type": "application/json" }); // guardrails-allow PREVENT-PI-004: loopback dashboard response (local)
+                    res.end(JSON.stringify({ error: "unknown_metric", metric: metricParam }));
+                    return;
+                }
+                const metric = metricParam; // validated against METRICS above
+                let limit = Number(url.searchParams.get("limit") ?? "10");
+                if (!Number.isFinite(limit) || limit <= 0)
+                    limit = 10;
+                limit = Math.min(Math.max(limit, 1), 100); // clamp to [1,100]
+                const rows = leaderboard(stateDir, metric, { limit }); // guardrails-allow PREVENT-PI-004: local SQLite read (loopback dashboard)
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(rows));
+            }
+            catch (e) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "game_scores_unavailable", detail: String(e) }));
+            }
+            return;
+        }
+        // /api/achievements — S35 achievement tiles. GET returns the 9 seeded rows
+        // {id,title,description,icon,hidden,unlocked_at}. The dashboard server is a
+        // detached child with no MegaRuntime ref, so it reads game_achievements via
+        // listAchievements(stateDir) directly. Non-GET -> 405. PREVENT-PI-004: loopback.
+        if (req.url?.startsWith("/api/achievements")) {
+            const achReq = createRequire(import.meta.url);
+            const { listAchievements } = achReq("../../src/store/sqlite.js");
+            if (req.method !== "GET") {
+                res.writeHead(405, { "Content-Type": "application/json" }); // guardrails-allow PREVENT-PI-004: loopback dashboard response (local)
+                res.end(JSON.stringify({ error: "method_not_allowed" }));
+                return;
+            }
+            try {
+                const rows = listAchievements(stateDir); // guardrails-allow PREVENT-PI-004: local SQLite read (loopback dashboard)
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(rows));
+            }
+            catch (e) {
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "achievements_unavailable", detail: String(e) }));
+            }
+            return;
+        }
+        // Fallback — serve the dashboard
+        const tier = readSnapshot(snapshotPath).tier;
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(dashboardHtml(tier));
+    });
+    // Bind base + range are env-configurable so tests can use a private,
+    // non-colliding range (parallel runs / leftover servers from killed runs
+    // would otherwise EADDRINUSE on the machine-global 9320 range). Default
+    // MEGACOMPACT_DASHBOARD_PORT=9320 (10-port range 9320–9329) preserves the
+    // production behavior.
+    const TARGET_PORT = Number(process.env.MEGACOMPACT_DASHBOARD_PORT ?? "9320");
+    const PORT_RANGE = 10; // TARGET_PORT..TARGET_PORT+9
+    return new Promise((resolve, reject) => {
+        function tryPort(port) {
+            server.once("error", (err) => {
+                if (err.code === "EADDRINUSE" && port < TARGET_PORT + PORT_RANGE - 1) {
+                    log("port in use, trying next", { port });
+                    tryPort(port + 1);
+                }
+                else {
+                    log("listen failed", { port, code: err.code, message: err.message });
+                    reject(err);
+                }
+            });
+            server.listen(port, "127.0.0.1", () => {
+                const url = `http://localhost:${port}`; // guardrails-allow PREVENT-PI-004: localhost dashboard URL (loopback-only)
+                log("server running", { url });
+                // eslint-disable-next-line no-console
+                console.log(`[mega-compact] dashboard server running: ${url}`);
+                // Write port.pid
+                try {
+                    writeFileSync(portFile, JSON.stringify({ port, pid: process.pid }));
+                }
+                catch (e) {
+                    log("could not write port.pid", { error: String(e) });
+                }
+                // Graceful cleanup
+                const cleanup = () => {
+                    try {
+                        unlinkSync(portFile);
+                    }
+                    catch { /* already gone */ }
+                    server.close();
+                    process.exit(0);
+                };
+                process.on("SIGTERM", cleanup);
+                process.on("SIGINT", cleanup);
+                resolve({ port, url });
+            });
+        }
+        tryPort(TARGET_PORT);
+    });
+}
+// ---------------------------------------------------------------------------
+// CLI entry point — when run directly as `node dashboard-server.js <stateDir>`
+// ---------------------------------------------------------------------------
+if (process.argv[1] && process.argv[1].includes("dashboard-server")) {
+    const stateDir = process.argv[2];
+    if (!stateDir) {
+        console.error("Usage: node dashboard-server.js <stateDir>");
+        process.exit(1);
+    }
+    launchDashboardServer(stateDir).catch((err) => {
+        console.error("[mega-compact] dashboard server failed:", err);
+        process.exit(1);
+    });
+}

package/dist/extensions/dashboard-server/server.test.js

@@ -0,0 +1,120 @@
+/**
+ * server.test.ts — S34 /api/game-scores endpoint (GET leaderboard, metric
+ * validation, method + limit handling). Mirrors the S32 /api/game-state
+ * spawn-and-fetch harness.
+ */
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { recordScore } from "../../src/store/sqlite.js";
+const SERVER_ENTRY = new URL("./server.js", import.meta.url).pathname;
+function waitFor(cond, timeoutMs = 6000) {
+    const start = Date.now();
+    return new Promise((resolve, reject) => {
+        const tick = async () => {
+            if (await cond())
+                return resolve();
+            if (Date.now() - start > timeoutMs)
+                return reject(new Error("timeout"));
+            setTimeout(tick, 50);
+        };
+        tick();
+    });
+}
+function freshDir(prefix) {
+    return mkdtempSync(join(tmpdir(), prefix));
+}
+async function withServer(port, dir, fn) {
+    process.env.MEGACOMPACT_DASHBOARD_PORT = port;
+    const child = spawn(process.execPath, [SERVER_ENTRY, dir], { stdio: "ignore" });
+    try {
+        await waitFor(async () => {
+            try {
+                const raw = JSON.parse(readFileSync(join(dir, "port.pid"), "utf-8"));
+                const res = await fetch(`http://localhost:${raw.port}/api/version`);
+                return res.ok;
+            }
+            catch {
+                return false;
+            }
+        });
+        const raw = JSON.parse(readFileSync(join(dir, "port.pid"), "utf-8"));
+        return await fn(raw.port);
+    }
+    finally {
+        child.kill("SIGTERM");
+        delete process.env.MEGACOMPACT_DASHBOARD_PORT;
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+describe("S34 /api/game-scores", () => {
+    test("GET ?metric=cache returns recorded rows as JSON array", async () => {
+        const dir = freshDir("dash-gs-cache-");
+        recordScore(dir, { repo_root: "/repo/a", metric: "cache", value: 42 });
+        await withServer("19430", dir, async (port) => {
+            const res = await fetch(`http://localhost:${port}/api/game-scores?metric=cache`);
+            assert.equal(res.status, 200);
+            const rows = (await res.json());
+            assert.ok(Array.isArray(rows));
+            assert.equal(rows.length, 1);
+            assert.equal(rows[0].repo_root, "/repo/a");
+            assert.equal(rows[0].value, 42);
+            assert.ok(typeof rows[0].ts === "number");
+        });
+    });
+    test("unknown metric -> 400", async () => {
+        const dir = freshDir("dash-gs-bad-");
+        await withServer("19431", dir, async (port) => {
+            const res = await fetch(`http://localhost:${port}/api/game-scores?metric=bogus`);
+            assert.equal(res.status, 400);
+        });
+    });
+    test("non-GET (POST) -> 405", async () => {
+        const dir = freshDir("dash-gs-meth-");
+        await withServer("19432", dir, async (port) => {
+            const res = await fetch(`http://localhost:${port}/api/game-scores`, { method: "POST" });
+            assert.equal(res.status, 405);
+        });
+    });
+    test("limit clamp: 3 rows -> default 10 returns 3, limit=2 caps to 2, limit<=0 clamps to >=1", async () => {
+        const dir = freshDir("dash-gs-lim-");
+        recordScore(dir, { repo_root: "/repo/a", metric: "cache", value: 1 });
+        recordScore(dir, { repo_root: "/repo/b", metric: "cache", value: 2 });
+        recordScore(dir, { repo_root: "/repo/c", metric: "cache", value: 3 });
+        await withServer("19433", dir, async (port) => {
+            const all = (await fetch(`http://localhost:${port}/api/game-scores?metric=cache`).then((r) => r.json()));
+            assert.equal(all.length, 3);
+            const capped = (await fetch(`http://localhost:${port}/api/game-scores?metric=cache&limit=2`).then((r) => r.json()));
+            assert.equal(capped.length, 2);
+            const zero = (await fetch(`http://localhost:${port}/api/game-scores?metric=cache&limit=0`).then((r) => r.json()));
+            assert.ok(zero.length >= 1, "limit<=0 clamps to >=1 row");
+        });
+    });
+});
+describe("S35 /api/achievements", () => {
+    test("GET returns the 9 seeded achievement rows", async () => {
+        const dir = freshDir("dash-ach-");
+        await withServer("19434", dir, async (port) => {
+            const res = await fetch(`http://localhost:${port}/api/achievements`);
+            assert.equal(res.status, 200);
+            const rows = (await res.json());
+            assert.ok(Array.isArray(rows));
+            assert.equal(rows.length, 9);
+            const opie = rows.find((r) => r.id === "opie_wild_ride");
+            assert.ok(opie, "opie_wild_ride seeded");
+            assert.equal(opie.hidden, 1);
+            assert.equal(opie.unlocked_at, null);
+            assert.equal(rows.find((r) => r.id === "first_compact").title, "First Compact");
+        });
+    });
+    test("non-GET (POST) -> 405", async () => {
+        const dir = freshDir("dash-ach-meth-");
+        await withServer("19435", dir, async (port) => {
+            const res = await fetch(`http://localhost:${port}/api/achievements`, { method: "POST" });
+            assert.equal(res.status, 405);
+        });
+    });
+});