robodev 0.36.0 → 0.37.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robodev",
-  "version": "0.36.0",
+  "version": "0.37.1",
   "description": "CLI for Robodev Starbase — create, auth, link, deploy, and run a project locally with robodev dev",
   "type": "module",
   "license": "MIT",
@@ -26,8 +26,8 @@
     "embedded-postgres": "17.10.0-beta.17",
     "fastify": "^5.12.1",
     "tsx": "^4.20.5",
-    "@robodev-ai/runtime": "0.4.1",
-    "@robodev-ai/sdk": "0.11.0"
+    "@robodev-ai/runtime": "0.4.2",
+    "@robodev-ai/sdk": "0.11.1"
   },
   "devDependencies": {
     "@types/node": "^24.3.0",

package/src/dev-clients.test.ts

@@ -0,0 +1,38 @@
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { consoleEmailClient } from "./dev-clients.js";
+import { createDevInspect } from "./dev-inspect.js";
+
+test("consoleEmailClient renders a local robodev/emails catalog file", async () => {
+  const root = await mkdtemp(join(tmpdir(), "robodev-dev-email-"));
+  await mkdir(join(root, "robodev", "emails"), { recursive: true });
+  await writeFile(join(root, "robodev", "emails", "welcome.html"), "<p>Hi {{name}}</p>", "utf8");
+  await writeFile(
+    join(root, "robodev", "emails", "welcome.json"),
+    JSON.stringify({ subject: "Hello {{name}}", text: "Hi {{name}}" }),
+    "utf8",
+  );
+  const lines: string[] = [];
+  const inspect = createDevInspect({ max: 20 });
+  const email = consoleEmailClient((line) => lines.push(line), inspect, root);
+  const result = await email.send({
+    to: "ada@example.com",
+    template: "welcome",
+    vars: { name: "Ada" },
+  });
+  assert.equal(result.status, "sent");
+  assert.match(lines[0] ?? "", /Hello Ada/);
+  assert.match(lines[1] ?? "", /Hi Ada/);
+});
+
+test("consoleEmailClient throws template_not_found without a local file or body", async () => {
+  const inspect = createDevInspect({ max: 20 });
+  const email = consoleEmailClient(() => undefined, inspect, await mkdtemp(join(tmpdir(), "robodev-dev-email-")));
+  await assert.rejects(
+    () => email.send({ to: "ada@example.com", template: "missing" }),
+    /template_not_found/,
+  );
+});

package/src/dev-clients.ts

@@ -1,11 +1,23 @@
 import {
   createLocalStorageClient,
   createProjectSocketsClient,
+  loadLocalEmailTemplate,
+  resolveEmailSendInput,
   type StorageQueryable,
 } from "@robodev-ai/runtime";
 import type { RouteClients } from "@robodev-ai/runtime";
-import type { EmailClient, JobEnqueueInput, LlmClient } from "@robodev-ai/sdk";
-import type { DevInspectStore } from "./dev-inspect.js";
+import type {
+  EmailClient,
+  JobEnqueueInput,
+  LlmClient,
+  SocketsClient,
+  StorageClient,
+} from "@robodev-ai/sdk";
+import {
+  truncateInspectPreview,
+  type DevInspectStore,
+  type StorageInspectOp,
+} from "./dev-inspect.js";
 
 /**
  * The `ctx.*` clients `robodev dev` can offer offline. `email` prints to the terminal;
@@ -21,17 +33,90 @@ function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
+function inspectStorageClient(client: StorageClient, inspect: DevInspectStore): StorageClient {
+  async function tracked<T>(op: StorageInspectOp, key: string, run: () => Promise<T>): Promise<T> {
+    try {
+      const result = await run();
+      inspect.record({ kind: "storage", op, key, ok: true });
+      return result;
+    } catch (error) {
+      inspect.record({
+        kind: "storage",
+        op,
+        key,
+        ok: false,
+        error: errorMessage(error),
+      });
+      throw error;
+    }
+  }
+  return {
+    upload: (key, data, options) => tracked("upload", key, () => client.upload(key, data, options)),
+    get: (key) => tracked("get", key, () => client.get(key)),
+    getUrl: (key, options) => tracked("getUrl", key, () => client.getUrl(key, options)),
+    delete: (key) => tracked("delete", key, () => client.delete(key)),
+    list: (options) => tracked("list", options?.prefix ?? "", () => client.list(options)),
+  };
+}
+
+function inspectSocketsClient(client: SocketsClient, inspect: DevInspectStore): SocketsClient {
+  function tracked(
+    socketKind: "send" | "broadcast",
+    name: string,
+    payload: unknown,
+    run: () => void,
+  ) {
+    try {
+      run();
+      inspect.record({
+        kind: "socket",
+        socketKind,
+        name,
+        preview: truncateInspectPreview(payload),
+      });
+    } catch (error) {
+      inspect.record({
+        kind: "socket",
+        socketKind,
+        name,
+        error: errorMessage(error),
+        preview: truncateInspectPreview(payload),
+      });
+      throw error;
+    }
+  }
+  return {
+    send(input) {
+      tracked("send", input.name, input.payload, () => client.send(input));
+    },
+    broadcast(input) {
+      tracked("broadcast", input.name, input.payload, () => client.broadcast(input));
+    },
+  };
+}
+
 /** Prints mail to stdout so local signup and reset flows are followable. */
 export function consoleEmailClient(
   log: (line: string) => void,
   inspect: DevInspectStore,
+  projectRoot?: string,
 ): EmailClient {
   return {
     async send(input) {
-      const to = Array.isArray(input.to) ? input.to.join(", ") : input.to;
-      log(`email → ${to}: ${input.subject}`);
-      if (input.text) log(`  ${input.text}`);
-      inspect.record({ kind: "email", to, subject: input.subject, text: input.text });
+      const catalog =
+        input.template && projectRoot
+          ? await loadLocalEmailTemplate(projectRoot, input.template)
+          : null;
+      const resolved = resolveEmailSendInput(input, catalog);
+      const to = Array.isArray(resolved.to) ? resolved.to.join(", ") : resolved.to;
+      log(`email → ${to}: ${resolved.subject ?? ""}`);
+      if (resolved.text) log(`  ${resolved.text}`);
+      inspect.record({
+        kind: "email",
+        to,
+        subject: resolved.subject ?? "",
+        text: resolved.text,
+      });
       return { id: `local_${Date.now().toString(36)}`, status: "sent" };
     },
   };
@@ -54,9 +139,10 @@ export function devRouteClients(input: {
   publicBaseUrl: string;
   projectId: string;
   jwtSecret: string;
+  projectRoot?: string;
 }): RouteClients {
   return {
-    email: consoleEmailClient(input.log, input.inspect),
+    email: consoleEmailClient(input.log, input.inspect, input.projectRoot),
     llm: offlineLlmClient(),
     agent: {
       createSession: () => notConfigured("llm_not_configured"),
@@ -65,13 +151,16 @@ export function devRouteClients(input: {
       subscribe: () => notConfigured("llm_not_configured"),
       destroy: () => notConfigured("llm_not_configured"),
     },
-    storage: createLocalStorageClient({
-      query: input.query,
-      objectsDir: input.objectsDir,
-      publicBaseUrl: input.publicBaseUrl,
-      projectId: input.projectId,
-      jwtSecret: input.jwtSecret,
-    }),
+    storage: inspectStorageClient(
+      createLocalStorageClient({
+        query: input.query,
+        objectsDir: input.objectsDir,
+        publicBaseUrl: input.publicBaseUrl,
+        projectId: input.projectId,
+        jwtSecret: input.jwtSecret,
+      }),
+      input.inspect,
+    ),
     push: { send: () => notConfigured("push_not_configured") },
     jobs: {
       enqueue: async (job) => {
@@ -96,7 +185,7 @@ export function devRouteClients(input: {
         }
       },
     },
-    sockets: createProjectSocketsClient(input.projectId),
+    sockets: inspectSocketsClient(createProjectSocketsClient(input.projectId), input.inspect),
     env: input.env,
   };
 }

package/src/dev-inspect.test.ts

@@ -8,6 +8,9 @@ import {
   isHistogramExcludedPath,
   isInspectPath,
   shouldCountRequestHistogram,
+  socketEventMatchesDef,
+  storageActivityMatchesKey,
+  truncateInspectPreview,
   type DevInspectAuthCodeEvent,
   type DevInspectEmailEvent,
   type DevInspectJobEvent,
@@ -25,7 +28,10 @@ test("isInspectPath covers dashboard pages and JSON only", () => {
   assert.equal(isInspectPath("/_robodev/jobs"), true);
   assert.equal(isInspectPath("/_robodev/emails"), true);
   assert.equal(isInspectPath("/_robodev/auth"), true);
+  assert.equal(isInspectPath("/_robodev/storage"), true);
+  assert.equal(isInspectPath("/_robodev/sockets"), true);
   assert.equal(isInspectPath("/_robodev/logs"), true);
+  assert.equal(isInspectPath("/storage/objects/avatar.png"), false);
   assert.equal(isInspectPath("/_robodev/state.json"), true);
   assert.equal(isInspectPath("/_robodev/logs.json"), true);
   assert.equal(isInspectPath("/_robodev/docs"), false);
@@ -43,6 +49,9 @@ test("shouldCountRequestHistogram counts Auth and matched file routes only", ()
   assert.equal(shouldCountRequestHistogram("/api/unknown", fileRuntime, "GET"), false);
   assert.equal(shouldCountRequestHistogram("/_robodev", fileRuntime, "GET"), false);
   assert.equal(shouldCountRequestHistogram("/_robodev/apis", fileRuntime, "GET"), false);
+  assert.equal(shouldCountRequestHistogram("/_robodev/storage", fileRuntime, "GET"), false);
+  assert.equal(shouldCountRequestHistogram("/_robodev/sockets", fileRuntime, "GET"), false);
+  assert.equal(shouldCountRequestHistogram("/storage/objects/a.png", fileRuntime, "GET"), false);
   assert.equal(shouldCountRequestHistogram("/_robodev/docs", fileRuntime, "GET"), false);
   assert.equal(shouldCountRequestHistogram("/_robodev/scalar", fileRuntime, "GET"), false);
   assert.equal(shouldCountRequestHistogram("/_robodev/ready", fileRuntime, "GET"), false);
@@ -223,6 +232,10 @@ test("dashboard snapshot lists reserved Auth, filters emails, and ignores enqueu
   assert.equal(state.jobRuns[0]?.status, "failed");
   assert.equal(state.overview.jobHistogram.at(-1)?.failed, 1);
   assert.deepEqual(state.auth.users, []);
+  assert.equal(state.overview.storageObjectCount, 0);
+  assert.equal(state.overview.socketCount, 0);
+  assert.deepEqual(state.storage, { objects: [], activity: [] });
+  assert.deepEqual(state.sockets, { connected: 0, defs: [], events: [] });
 });
 
 test("incomplete Google credentials are not labeled override", async () => {
@@ -242,6 +255,10 @@ test("inspect HTML has nav labels and polls state.json", () => {
   assert.match(html, />Jobs</);
   assert.match(html, />Emails</);
   assert.match(html, />Auth</);
+  assert.match(html, />Storage</);
+  assert.match(html, />Sockets</);
+  assert.match(html, /\/_robodev\/storage/);
+  assert.match(html, /\/_robodev\/sockets/);
   assert.doesNotMatch(html, /<h2>Requests<\/h2>/);
   assert.doesNotMatch(html, /<h2>Emails<\/h2>/);
   assert.doesNotMatch(html, /<h2>Jobs<\/h2>/);
@@ -250,3 +267,119 @@ test("inspect HTML has nav labels and polls state.json", () => {
   assert.doesNotMatch(html, /fetch\("\/_robodev\/logs\.json"\)/);
   assert.match(html, /setInterval\(poll, 1000\)/);
 });
+
+test("storageActivityMatchesKey uses exact key except list prefixes", () => {
+  assert.equal(storageActivityMatchesKey({ op: "upload", key: "a/b" }, "a/b"), true);
+  assert.equal(storageActivityMatchesKey({ op: "get", key: "a/b" }, "a/c"), false);
+  assert.equal(storageActivityMatchesKey({ op: "getUrl", key: "a/b" }, "a/b"), true);
+  assert.equal(storageActivityMatchesKey({ op: "delete", key: "a/b" }, "a/b"), true);
+  assert.equal(storageActivityMatchesKey({ op: "serve", key: "a/b" }, "a/b"), true);
+  assert.equal(storageActivityMatchesKey({ op: "list", key: "" }, "a/b"), true);
+  assert.equal(storageActivityMatchesKey({ op: "list", key: "a/" }, "a/b"), true);
+  assert.equal(storageActivityMatchesKey({ op: "list", key: "a/" }, "a/"), true);
+  assert.equal(storageActivityMatchesKey({ op: "list", key: "b" }, "a/b"), false);
+});
+
+test("socketEventMatchesDef matches path params or name", () => {
+  const chat = { path: "/sockets/chat", name: "chat" };
+  const room = { path: "/sockets/room/:id", name: "room" };
+  assert.equal(socketEventMatchesDef({ path: "/sockets/chat", name: "chat" }, chat), true);
+  assert.equal(socketEventMatchesDef({ name: "chat" }, chat), true);
+  assert.equal(socketEventMatchesDef({ path: "/sockets/other" }, chat), false);
+  assert.equal(socketEventMatchesDef({ path: "/sockets/room/abc" }, room), true);
+  assert.equal(socketEventMatchesDef({ name: "room" }, room), true);
+});
+
+test("truncateInspectPreview caps text and JSON at 200", () => {
+  assert.equal(truncateInspectPreview("short"), "short");
+  assert.equal(truncateInspectPreview({ a: 1 }), '{"a":1}');
+  const long = "x".repeat(220);
+  const preview = truncateInspectPreview(long);
+  assert.equal(preview.length, 201);
+  assert.equal(preview.endsWith("…"), true);
+});
+
+test("dashboard snapshot includes storage objects, activity, and socket defs", async () => {
+  const inspect = createDevInspect();
+  inspect.record({ kind: "storage", op: "upload", key: "a.png", ok: true });
+  inspect.record({ kind: "storage", op: "list", key: "", ok: true });
+  inspect.record({ kind: "storage", op: "serve", key: "missing", ok: false, error: "not_found" });
+  inspect.record({
+    kind: "socket",
+    socketKind: "connect",
+    path: "/sockets/chat",
+    name: "chat",
+    userId: "u1",
+  });
+  inspect.record({
+    kind: "socket",
+    socketKind: "send",
+    name: "chat",
+    preview: '{"hi":1}',
+  });
+
+  const pool = {
+    query: async <R extends Record<string, unknown>>(sql: string) => {
+      if (sql.includes("robodev_auth.users")) return { rows: [] as unknown as R[] };
+      if (sql.includes("count(*)") && sql.includes("robodev_storage.objects")) {
+        return { rows: [{ count: "2" }] as unknown as R[] };
+      }
+      if (sql.includes("robodev_storage.objects")) {
+        return {
+          rows: [
+            {
+              key: "a.png",
+              public: true,
+              size_bytes: 12,
+              content_type: "image/png",
+              created_at: new Date("2026-01-01T00:00:00.000Z"),
+            },
+          ] as unknown as R[],
+        };
+      }
+      return { rows: [] as unknown as R[] };
+    },
+  };
+
+  const state = await buildDashboardState({
+    inspect,
+    projectId: "local",
+    runtime: {
+      routes: [],
+      jobs: [],
+      sockets: [
+        { name: "chat", path: "/sockets/chat", file: "sockets/chat.ts", def: { auth: false } },
+      ],
+      pool,
+    },
+  });
+
+  assert.equal(state.overview.storageObjectCount, 2);
+  assert.equal(state.overview.socketCount, 1);
+  assert.equal(state.storage.objects.length, 1);
+  assert.equal(state.storage.objects[0]?.url, "/storage/objects/a.png");
+  assert.equal(state.storage.objects[0]?.sizeBytes, 12);
+  assert.equal(state.storage.activity.length, 3);
+  assert.equal(state.storage.activity[0]?.op, "serve");
+  assert.equal(state.sockets.defs[0]?.auth, "public");
+  assert.equal(state.sockets.connected, 0);
+  assert.equal(state.sockets.events.length, 2);
+  assert.equal(state.sockets.events[0]?.socketKind, "send");
+});
+
+test("storage object count is 0 when the query fails", async () => {
+  const state = await buildDashboardState({
+    inspect: createDevInspect(),
+    runtime: {
+      routes: [],
+      jobs: [],
+      pool: {
+        query: async () => {
+          throw new Error("missing schema");
+        },
+      },
+    },
+  });
+  assert.equal(state.overview.storageObjectCount, 0);
+  assert.deepEqual(state.storage.objects, []);
+});

package/src/dev-inspect.ts

@@ -3,7 +3,10 @@ import {
   matchPathParams,
   matchProjectRoute,
   projectGoogleOverrideMode,
+  projectSocketCount,
+  socketAuthDisplay,
 } from "@robodev-ai/runtime";
+import type { ApiAuth } from "@robodev-ai/sdk";
 
 export const DEV_INSPECT_MAX = 500;
 export const HISTOGRAM_MINUTES = 120;
@@ -14,6 +17,8 @@ const DASHBOARD_HTML_PATHS = new Set([
   "/_robodev/jobs",
   "/_robodev/emails",
   "/_robodev/auth",
+  "/_robodev/storage",
+  "/_robodev/sockets",
   "/_robodev/logs",
 ]);
 
@@ -47,7 +52,13 @@ export const RESERVED_AUTH_ROUTES: Array<{ method: string; path: string; file: s
   { method: "PUT", path: "/api/user/me", file: "reserved" },
 ];
 
-export type DevInspectKind = "request" | "email" | "auth_code" | "job" | "job_run" | "log";
+export const SOCKET_PREVIEW_MAX = 200;
+
+export type DevInspectKind =
+  "request" | "email" | "auth_code" | "job" | "job_run" | "log" | "storage" | "socket";
+
+export type StorageInspectOp = "upload" | "get" | "getUrl" | "delete" | "list" | "serve";
+export type SocketInspectKind = "connect" | "message" | "close" | "send" | "broadcast";
 
 type EventBase = {
   id: string;
@@ -96,13 +107,35 @@ export type DevInspectLogEvent = EventBase & {
   message: string;
 };
 
+export type DevInspectStorageEvent = EventBase & {
+  kind: "storage";
+  op: StorageInspectOp;
+  key: string;
+  ok: boolean;
+  error?: string;
+};
+
+export type DevInspectSocketEvent = EventBase & {
+  kind: "socket";
+  socketKind: SocketInspectKind;
+  path?: string;
+  name?: string;
+  userId?: string | null;
+  code?: number;
+  reason?: string;
+  error?: string;
+  preview?: string;
+};
+
 export type DevInspectEvent =
   | DevInspectRequestEvent
   | DevInspectEmailEvent
   | DevInspectAuthCodeEvent
   | DevInspectJobEvent
   | DevInspectJobRunEvent
-  | DevInspectLogEvent;
+  | DevInspectLogEvent
+  | DevInspectStorageEvent
+  | DevInspectSocketEvent;
 
 export type DevInspectRecordInput =
   | Omit<DevInspectRequestEvent, "id" | "at">
@@ -110,17 +143,57 @@ export type DevInspectRecordInput =
   | Omit<DevInspectAuthCodeEvent, "id" | "at">
   | Omit<DevInspectJobEvent, "id" | "at">
   | Omit<DevInspectJobRunEvent, "id" | "at">
-  | Omit<DevInspectLogEvent, "id" | "at">;
+  | Omit<DevInspectLogEvent, "id" | "at">
+  | Omit<DevInspectStorageEvent, "id" | "at">
+  | Omit<DevInspectSocketEvent, "id" | "at">;
 
 export type DashboardGoogle = "broker" | "local_override" | "incomplete";
 
 export type RequestHistogramBucket = { t: number; c2xx: number; c4xx: number; c5xx: number };
 export type JobHistogramBucket = { t: number; succeeded: number; failed: number };
 
+export type DashboardStorageObject = {
+  key: string;
+  public: boolean;
+  sizeBytes: number;
+  contentType: string;
+  createdAt: string;
+  url: string;
+};
+
+export type DashboardStorageActivity = {
+  at: number;
+  op: StorageInspectOp;
+  key: string;
+  ok: boolean;
+  error?: string;
+};
+
+export type DashboardSocketDef = {
+  path: string;
+  file: string;
+  auth: "required" | "public";
+  name: string;
+};
+
+export type DashboardSocketEvent = {
+  at: number;
+  socketKind: SocketInspectKind;
+  path?: string;
+  name?: string;
+  userId?: string | null;
+  code?: number;
+  reason?: string;
+  error?: string;
+  preview?: string;
+};
+
 export type DashboardState = {
   overview: {
     apiCount: number;
     jobCount: number;
+    storageObjectCount: number;
+    socketCount: number;
     google: DashboardGoogle;
     requestHistogram: RequestHistogramBucket[];
     jobHistogram: JobHistogramBucket[];
@@ -141,11 +214,21 @@ export type DashboardState = {
     google: DashboardGoogle;
     users: Array<{ id: string; email: string; name: string | null; createdAt: string }>;
   };
+  storage: {
+    objects: DashboardStorageObject[];
+    activity: DashboardStorageActivity[];
+  };
+  sockets: {
+    connected: number;
+    defs: DashboardSocketDef[];
+    events: DashboardSocketEvent[];
+  };
 };
 
 export type DashboardRuntime = {
   routes: Array<{ method: string; path: string; file: string }>;
   jobs: Array<{ name: string; file: string; def: { cron?: string } }>;
+  sockets?: Array<{ name: string; path: string; file: string; def: { auth?: ApiAuth } }>;
   pool?: {
     query: <R extends Record<string, unknown> = Record<string, unknown>>(
       sql: string,
@@ -196,6 +279,41 @@ export function callMatchesRoute(
   return matchPathParams(prefixed, call.path) !== null;
 }
 
+/** Exact key for object ops; list matches empty prefix, the prefix itself, or a key under it. */
+export function storageActivityMatchesKey(
+  event: { op: StorageInspectOp; key: string },
+  selectedKey: string,
+): boolean {
+  if (event.op === "list") {
+    const prefix = event.key;
+    return prefix === "" || selectedKey === prefix || selectedKey.startsWith(prefix);
+  }
+  return event.key === selectedKey;
+}
+
+export function socketEventMatchesDef(
+  event: { path?: string; name?: string },
+  socket: { path: string; name: string },
+): boolean {
+  if (event.path && matchPathParams(socket.path, event.path)) return true;
+  return event.name === socket.name;
+}
+
+export function truncateInspectPreview(value: unknown, max = SOCKET_PREVIEW_MAX): string {
+  let text: string;
+  if (typeof value === "string") {
+    text = value;
+  } else {
+    try {
+      text = JSON.stringify(value) ?? "";
+    } catch {
+      text = "[unserializable]";
+    }
+  }
+  if (text.length <= max) return text;
+  return `${text.slice(0, max)}…`;
+}
+
 export function googleDashboardStatus(mode: "both" | "one" | "none"): DashboardGoogle {
   if (mode === "both") return "local_override";
   if (mode === "one") return "incomplete";
@@ -305,6 +423,11 @@ export function createDevInspect(options?: { max?: number }): DevInspectStore {
   };
 }
 
+function isoTimestamp(value: Date | string | undefined): string {
+  if (value instanceof Date) return value.toISOString();
+  return String(value ?? "");
+}
+
 async function loadAuthUsers(
   pool: NonNullable<DashboardRuntime>["pool"],
 ): Promise<DashboardState["auth"]["users"]> {
@@ -320,10 +443,50 @@ async function loadAuthUsers(
       id: row.id,
       email: row.email,
       name: row.name ?? null,
-      createdAt:
-        row.created_at instanceof Date
-          ? row.created_at.toISOString()
-          : String(row.created_at ?? ""),
+      createdAt: isoTimestamp(row.created_at),
+    }));
+  } catch {
+    return [];
+  }
+}
+
+async function loadStorageObjectCount(
+  pool: NonNullable<DashboardRuntime>["pool"],
+): Promise<number> {
+  if (!pool) return 0;
+  try {
+    const result = await pool.query<{ count: string | number }>(
+      `SELECT count(*) FROM robodev_storage.objects`,
+    );
+    return Number(result.rows[0]?.count ?? 0);
+  } catch {
+    return 0;
+  }
+}
+
+async function loadStorageObjects(
+  pool: NonNullable<DashboardRuntime>["pool"],
+): Promise<DashboardStorageObject[]> {
+  if (!pool) return [];
+  try {
+    const result = await pool.query<{
+      key: string;
+      public: boolean;
+      size_bytes: string | number;
+      content_type: string;
+      created_at: Date | string;
+    }>(
+      `SELECT key, public, size_bytes, content_type, created_at
+       FROM robodev_storage.objects
+       ORDER BY created_at DESC`,
+    );
+    return result.rows.map((row) => ({
+      key: row.key,
+      public: Boolean(row.public),
+      sizeBytes: Number(row.size_bytes),
+      contentType: row.content_type,
+      createdAt: isoTimestamp(row.created_at),
+      url: `/storage/objects/${row.key}`,
     }));
   } catch {
     return [];
@@ -333,6 +496,7 @@ async function loadAuthUsers(
 export async function buildDashboardState(input: {
   inspect: DevInspectStore;
   runtime: DashboardRuntime;
+  projectId?: string;
   googleClientId?: string;
   googleClientSecret?: string;
 }): Promise<DashboardState> {
@@ -378,11 +542,41 @@ export async function buildDashboardState(input: {
     cron: job.def.cron ?? null,
     file: job.file,
   }));
+  const activity = newest
+    .filter((event): event is DevInspectStorageEvent => event.kind === "storage")
+    .map((event) => ({
+      at: event.at,
+      op: event.op,
+      key: event.key,
+      ok: event.ok,
+      error: event.error,
+    }));
+  const socketEvents = newest
+    .filter((event): event is DevInspectSocketEvent => event.kind === "socket")
+    .map((event) => ({
+      at: event.at,
+      socketKind: event.socketKind,
+      path: event.path,
+      name: event.name,
+      userId: event.userId,
+      code: event.code,
+      reason: event.reason,
+      error: event.error,
+      preview: event.preview,
+    }));
+  const socketDefs = (input.runtime?.sockets ?? []).map((socket) => ({
+    path: socket.path,
+    file: socket.file,
+    auth: socketAuthDisplay(socket.def.auth ?? false),
+    name: socket.name,
+  }));
 
   return {
     overview: {
       apiCount: routes.length,
       jobCount: jobs.length,
+      storageObjectCount: await loadStorageObjectCount(input.runtime?.pool),
+      socketCount: socketDefs.length,
       google,
       requestHistogram: input.inspect.requestHistogram(),
       jobHistogram: input.inspect.jobHistogram(),
@@ -397,6 +591,15 @@ export async function buildDashboardState(input: {
       google,
       users: await loadAuthUsers(input.runtime?.pool),
     },
+    storage: {
+      objects: await loadStorageObjects(input.runtime?.pool),
+      activity,
+    },
+    sockets: {
+      connected: input.projectId ? projectSocketCount(input.projectId) : 0,
+      defs: socketDefs,
+      events: socketEvents,
+    },
   };
 }
 
@@ -488,6 +691,8 @@ export function inspectHtml(): string {
         <a href="/_robodev/jobs" data-nav="jobs">Jobs</a>
         <a href="/_robodev/emails" data-nav="emails">Emails</a>
         <a href="/_robodev/auth" data-nav="auth">Auth</a>
+        <a href="/_robodev/storage" data-nav="storage">Storage</a>
+        <a href="/_robodev/sockets" data-nav="sockets">Sockets</a>
       </nav>
     </header>
     <p class="lead">Local dashboard. Readonly. Polls every 1s.</p>
@@ -496,6 +701,8 @@ export function inspectHtml(): string {
       <div class="cards">
         <div class="card"><div class="label">APIs</div><div class="value" id="api-count">0</div></div>
         <div class="card"><div class="label">Jobs</div><div class="value" id="job-count">0</div></div>
+        <div class="card"><div class="label">Storage</div><div class="value" id="storage-count">0</div></div>
+        <div class="card"><div class="label">Sockets</div><div class="value" id="socket-count">0</div></div>
         <div class="card"><div class="label">Auth</div><div class="note" id="google-line"></div></div>
       </div>
       <div class="links" id="doc-links"></div>
@@ -544,16 +751,43 @@ export function inspectHtml(): string {
       <div id="auth-users"></div>
     </section>
 
+    <section id="page-storage" class="page">
+      <div class="tabs">
+        <button type="button" data-storage-tab="objects">Objects</button>
+        <button type="button" data-storage-tab="activity">Activity</button>
+      </div>
+      <div id="storage-filter" class="filter" hidden></div>
+      <div id="storage-objects"></div>
+      <div id="storage-activity" hidden></div>
+    </section>
+
+    <section id="page-sockets" class="page">
+      <p class="lead" id="sockets-connected">0 connected</p>
+      <div class="tabs">
+        <button type="button" data-socket-tab="sockets">Sockets</button>
+        <button type="button" data-socket-tab="events">Events</button>
+      </div>
+      <div id="sockets-filter" class="filter" hidden></div>
+      <div id="sockets-defs"></div>
+      <div id="sockets-events" hidden></div>
+    </section>
+
     <script>
       var PAGES = {
         "/_robodev": "overview",
         "/_robodev/apis": "apis",
         "/_robodev/jobs": "jobs",
         "/_robodev/emails": "emails",
-        "/_robodev/auth": "auth"
+        "/_robodev/auth": "auth",
+        "/_robodev/storage": "storage",
+        "/_robodev/sockets": "sockets"
       };
       var apisTab = "routes";
+      var storageTab = "objects";
+      var socketTab = "sockets";
       var callFilter = null;
+      var storageFilter = null;
+      var socketFilter = null;
       var lastState = null;
 
       function pagePath() {
@@ -586,6 +820,17 @@ export function inspectHtml(): string {
         var prefixed = route.path === "/" ? "/api" : "/api" + route.path;
         return matchPathParams(prefixed, call.path) !== null;
       }
+      function storageActivityMatches(event, selectedKey) {
+        if (event.op === "list") {
+          var prefix = event.key;
+          return prefix === "" || selectedKey === prefix || selectedKey.indexOf(prefix) === 0;
+        }
+        return event.key === selectedKey;
+      }
+      function socketEventMatches(event, socket) {
+        if (event.path && matchPathParams(socket.path, event.path)) return true;
+        return event.name === socket.name;
+      }
       function timeLabel(at) {
         return new Date(at).toLocaleTimeString();
       }
@@ -682,11 +927,45 @@ export function inspectHtml(): string {
         document.getElementById("apis-routes").hidden = tab !== "routes";
         document.getElementById("apis-calls").hidden = tab !== "calls";
       }
+      function setStorageTab(tab) {
+        storageTab = tab;
+        document.querySelector('[data-storage-tab="objects"]').className = tab === "objects" ? "active" : "";
+        document.querySelector('[data-storage-tab="activity"]').className = tab === "activity" ? "active" : "";
+        document.getElementById("storage-objects").hidden = tab !== "objects";
+        document.getElementById("storage-activity").hidden = tab !== "activity";
+      }
+      function setSocketTab(tab) {
+        socketTab = tab;
+        document.querySelector('[data-socket-tab="sockets"]').className = tab === "sockets" ? "active" : "";
+        document.querySelector('[data-socket-tab="events"]').className = tab === "events" ? "active" : "";
+        document.getElementById("sockets-defs").hidden = tab !== "sockets";
+        document.getElementById("sockets-events").hidden = tab !== "events";
+      }
+      function renderFilter(el, labelText, onClear) {
+        if (!labelText) {
+          el.hidden = true;
+          el.replaceChildren();
+          return;
+        }
+        el.hidden = false;
+        el.replaceChildren();
+        var label = document.createElement("span");
+        label.textContent = labelText;
+        var clear = document.createElement("button");
+        clear.type = "button";
+        clear.className = "clear";
+        clear.textContent = "Clear filter";
+        clear.addEventListener("click", onClear);
+        el.appendChild(label);
+        el.appendChild(clear);
+      }
       function render(state) {
         lastState = state;
         markNav();
         document.getElementById("api-count").textContent = String(state.overview.apiCount);
         document.getElementById("job-count").textContent = String(state.overview.jobCount);
+        document.getElementById("storage-count").textContent = String(state.overview.storageObjectCount);
+        document.getElementById("socket-count").textContent = String(state.overview.socketCount);
         document.getElementById("google-line").textContent = googleLabel(state.overview.google);
         var links = document.getElementById("doc-links");
         links.replaceChildren();
@@ -784,6 +1063,88 @@ export function inspectHtml(): string {
             return { cells: [user.id, user.email, user.name || "", user.createdAt] };
           })
         ));
+
+        fill(document.getElementById("storage-objects"), table(
+          ["Key", "Public", "Size", "Type", "Created", "URL"],
+          state.storage.objects.map(function (object) {
+            return { cells: [object.key, object.public ? "public" : "private", object.sizeBytes, object.contentType, object.createdAt, object.url], object: object };
+          }),
+          function (row) {
+            storageFilter = row.object.key;
+            setStorageTab("activity");
+            render(lastState);
+          }
+        ));
+        var storageEvents = state.storage.activity;
+        if (storageFilter) {
+          storageEvents = state.storage.activity.filter(function (event) {
+            return storageActivityMatches(event, storageFilter);
+          });
+        }
+        renderFilter(
+          document.getElementById("storage-filter"),
+          storageFilter ? "Filtered to " + storageFilter : null,
+          function () {
+            storageFilter = null;
+            render(lastState);
+          }
+        );
+        fill(document.getElementById("storage-activity"), table(
+          ["Time", "Op", "Key", "Status"],
+          storageEvents.map(function (event) {
+            var status = event.ok
+              ? { html: '<span class="ok-text">ok</span>' }
+              : { html: '<span class="bad-text">' + (event.error || "error") + "</span>" };
+            return { cells: [timeLabel(event.at), event.op, event.key, status] };
+          })
+        ));
+        setStorageTab(storageTab);
+
+        document.getElementById("sockets-connected").textContent = String(state.sockets.connected) + " connected";
+        fill(document.getElementById("sockets-defs"), table(
+          ["Path", "File", "Auth"],
+          state.sockets.defs.map(function (socket) {
+            return { cells: [socket.path, socket.file, socket.auth], socket: socket };
+          }),
+          function (row) {
+            socketFilter = { path: row.socket.path, name: row.socket.name };
+            setSocketTab("events");
+            render(lastState);
+          }
+        ));
+        var socketEvents = state.sockets.events;
+        if (socketFilter) {
+          socketEvents = state.sockets.events.filter(function (event) {
+            return socketEventMatches(event, socketFilter);
+          });
+        }
+        renderFilter(
+          document.getElementById("sockets-filter"),
+          socketFilter ? "Filtered to " + socketFilter.path : null,
+          function () {
+            socketFilter = null;
+            render(lastState);
+          }
+        );
+        fill(document.getElementById("sockets-events"), table(
+          ["Time", "Kind", "Path / name", "User", "Detail", "Preview"],
+          socketEvents.map(function (event) {
+            var detail = event.error
+              ? { html: '<span class="bad-text">' + event.error + "</span>" }
+              : [event.code, event.reason].filter(function (part) { return part !== undefined && part !== ""; }).join(" ");
+            return {
+              cells: [
+                timeLabel(event.at),
+                event.socketKind,
+                event.path || event.name || "",
+                event.userId || "",
+                detail,
+                event.preview || ""
+              ]
+            };
+          })
+        ));
+        setSocketTab(socketTab);
       }
       document.querySelector('[data-tab="routes"]').addEventListener("click", function () {
         setApisTab("routes");
@@ -793,6 +1154,22 @@ export function inspectHtml(): string {
         setApisTab("calls");
         if (lastState) render(lastState);
       });
+      document.querySelector('[data-storage-tab="objects"]').addEventListener("click", function () {
+        setStorageTab("objects");
+      });
+      document.querySelector('[data-storage-tab="activity"]').addEventListener("click", function () {
+        storageFilter = null;
+        setStorageTab("activity");
+        if (lastState) render(lastState);
+      });
+      document.querySelector('[data-socket-tab="sockets"]').addEventListener("click", function () {
+        setSocketTab("sockets");
+      });
+      document.querySelector('[data-socket-tab="events"]').addEventListener("click", function () {
+        socketFilter = null;
+        setSocketTab("events");
+        if (lastState) render(lastState);
+      });
       async function poll() {
         try {
           var state = await fetch("/_robodev/state.json").then(function (r) { return r.json(); });
@@ -801,6 +1178,8 @@ export function inspectHtml(): string {
       }
       markNav();
       setApisTab("routes");
+      setStorageTab("objects");
+      setSocketTab("sockets");
       poll();
       setInterval(poll, 1000);
     </script>

package/src/dev-server.ts

@@ -36,6 +36,7 @@ import {
   buildDashboardState,
   isInspectPath,
   shouldCountRequestHistogram,
+  truncateInspectPreview,
   type DevInspectStore,
 } from "./dev-inspect.js";
 
@@ -62,6 +63,7 @@ export type DevServerOptions = {
   googleClientId?: string;
   googleClientSecret?: string;
   storageDir: string;
+  projectRoot?: string;
 };
 
 const SWAGGER_PATHS = new Set(["/_robodev/docs", "/_robodev/swagger", "/docs", "/swagger"]);
@@ -128,6 +130,7 @@ function routeClients(options: DevServerOptions, getRuntime: () => DevRuntime |
     publicBaseUrl: options.listenOrigin,
     projectId: options.projectId,
     jwtSecret: options.jwtSecret,
+    projectRoot: options.projectRoot,
   });
 }
 
@@ -156,26 +159,52 @@ async function resolveSocketUser(
   return { ok: true, user };
 }
 
+function recordSocketHandshake(
+  inspect: DevInspectStore,
+  input: {
+    path: string;
+    name?: string;
+    userId?: string | null;
+    error?: string;
+  },
+): void {
+  inspect.record({
+    kind: "socket",
+    socketKind: "connect",
+    path: input.path,
+    name: input.name,
+    userId: input.userId,
+    error: input.error,
+  });
+}
+
 async function handleLocalSocket(
   socket: WebSocket,
   request: FastifyRequest,
   options: DevServerOptions,
   getRuntime: () => DevRuntime | null,
 ): Promise<void> {
+  const pathname = pathnameOf(request.url);
   const runtime = getRuntime();
   if (!runtime) {
+    recordSocketHandshake(options.inspect, { path: pathname, error: "not_found" });
     socket.close(SOCKET_CLOSE_POLICY, "not_found");
     return;
   }
-  const pathname = pathnameOf(request.url);
   const matched = matchSocketRoute(pathname, runtime.sockets);
   if (!matched) {
+    recordSocketHandshake(options.inspect, { path: pathname, error: "not_found" });
     socket.close(SOCKET_CLOSE_POLICY, "not_found");
     return;
   }
 
   const auth = await resolveSocketUser(options, matched.socket.def, request);
   if (!auth.ok) {
+    recordSocketHandshake(options.inspect, {
+      path: pathname,
+      name: matched.socket.name,
+      error: "unauthorized",
+    });
     socket.close(SOCKET_CLOSE_POLICY, "unauthorized");
     return;
   }
@@ -215,12 +244,24 @@ async function handleLocalSocket(
     onClose: matched.socket.def.onClose,
   });
   if (!session.ok) {
+    recordSocketHandshake(options.inspect, {
+      path: pathname,
+      name: matched.socket.name,
+      userId: auth.user?.id ?? null,
+      error: session.reason,
+    });
     if (socket.readyState === socket.OPEN) {
       socket.close(session.code, session.reason);
     }
     return;
   }
 
+  recordSocketHandshake(options.inspect, {
+    path: pathname,
+    name: matched.socket.name,
+    userId: auth.user?.id ?? null,
+  });
+
   let alive = true;
   const pingTimer = setInterval(() => {
     if (socket.readyState !== socket.OPEN) {
@@ -245,18 +286,52 @@ async function handleLocalSocket(
   });
   socket.on("message", (data, isBinary) => {
     if (isBinary) {
+      options.inspect.record({
+        kind: "socket",
+        socketKind: "message",
+        path: pathname,
+        name: matched.socket.name,
+        userId: auth.user?.id ?? null,
+        error: "binary",
+      });
       session.onBinary();
       return;
     }
     const text = typeof data === "string" ? data : Buffer.from(data as Uint8Array).toString("utf8");
+    options.inspect.record({
+      kind: "socket",
+      socketKind: "message",
+      path: pathname,
+      name: matched.socket.name,
+      userId: auth.user?.id ?? null,
+      preview: truncateInspectPreview(text),
+    });
     session.onText(text);
   });
-  socket.on("close", () => {
+  socket.on("close", (code, reason) => {
     clearInterval(pingTimer);
+    options.inspect.record({
+      kind: "socket",
+      socketKind: "close",
+      path: pathname,
+      name: matched.socket.name,
+      userId: auth.user?.id ?? null,
+      code,
+      reason: reason?.toString() || undefined,
+    });
     session.onClose();
   });
 }
 
+function recordStorageServe(
+  inspect: DevInspectStore,
+  key: string,
+  ok: boolean,
+  error?: string,
+): void {
+  inspect.record({ kind: "storage", op: "serve", key, ok, error });
+}
+
 async function serveLocalStorage(
   request: FastifyRequest,
   reply: FastifyReply,
@@ -264,12 +339,13 @@ async function serveLocalStorage(
   getRuntime: () => DevRuntime | null,
   pathname: string,
 ): Promise<void> {
+  const encodedKey = pathname.slice("/storage/objects/".length);
   const runtime = getRuntime();
   if (!runtime) {
     await reply.code(503).send({ error: "not_ready" });
+    recordStorageServe(options.inspect, encodedKey, false, "not_ready");
     return;
   }
-  const encodedKey = pathname.slice("/storage/objects/".length);
   let key: string;
   try {
     key = decodeURIComponent(encodedKey);
@@ -278,9 +354,12 @@ async function serveLocalStorage(
     const mapped = codedErrorBody(error);
     if (mapped) {
       await reply.code(mapped.status).send(mapped.body);
+      const mappedError = typeof mapped.body.error === "string" ? mapped.body.error : "invalid_key";
+      recordStorageServe(options.inspect, encodedKey, false, mappedError);
       return;
     }
     await reply.code(400).send({ error: "invalid_key" });
+    recordStorageServe(options.inspect, encodedKey, false, "invalid_key");
     return;
   }
 
@@ -291,6 +370,7 @@ async function serveLocalStorage(
   });
   if (!resolved) {
     await reply.code(404).send({ error: "not_found" });
+    recordStorageServe(options.inspect, key, false, "not_found");
     return;
   }
 
@@ -306,10 +386,12 @@ async function serveLocalStorage(
   );
   if (!resolved.row.public && !user && !signed) {
     await reply.code(404).send({ error: "not_found" });
+    recordStorageServe(options.inspect, key, false, "not_found");
     return;
   }
 
   await reply.type(resolved.row.content_type).send(resolved.body);
+  recordStorageServe(options.inspect, key, true);
 }
 
 /**
@@ -390,6 +472,7 @@ export async function startDevServer(
           await buildDashboardState({
             inspect: options.inspect,
             runtime: getRuntime(),
+            projectId: options.projectId,
             googleClientId: options.googleClientId,
             googleClientSecret: options.googleClientSecret,
           }),

package/src/dev.ts

@@ -191,6 +191,7 @@ export async function main(args: string[]): Promise<void> {
         publicBaseUrl: `http://localhost:${parsed.port}`,
         projectId: DEV_PROJECT_ID,
         jwtSecret: DEV_JWT_SECRET,
+        projectRoot: project.root,
       }),
     onJobFinished: (event) => {
       inspect.record({
@@ -310,6 +311,7 @@ export async function main(args: string[]): Promise<void> {
         googleClientId: env.GOOGLE_CLIENT_ID,
         googleClientSecret: env.GOOGLE_CLIENT_SECRET,
         storageDir,
+        projectRoot: project.root,
       },
       () => current,
     );

package/templates/auth-chat/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.11.0"
+    "@robodev-ai/sdk": "^0.11.1"
   },
   "devDependencies": {
-    "robodev": "^0.36.0",
+    "robodev": "^0.37.1",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/package.json

@@ -8,10 +8,10 @@
     "deploy": "robodev deploy"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.11.0"
+    "@robodev-ai/sdk": "^0.11.1"
   },
   "devDependencies": {
-    "robodev": "^0.36.0",
+    "robodev": "^0.37.1",
     "typescript": "^5.9.2"
   }
 }

package/templates/empty/package.json

@@ -8,10 +8,10 @@
     "deploy": "robodev deploy"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.11.0"
+    "@robodev-ai/sdk": "^0.11.1"
   },
   "devDependencies": {
-    "robodev": "^0.36.0",
+    "robodev": "^0.37.1",
     "typescript": "^5.9.2"
   }
 }

package/templates/marketplace/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.11.0"
+    "@robodev-ai/sdk": "^0.11.1"
   },
   "devDependencies": {
-    "robodev": "^0.36.0",
+    "robodev": "^0.37.1",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/space/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.11.0"
+    "@robodev-ai/sdk": "^0.11.1"
   },
   "devDependencies": {
-    "robodev": "^0.36.0",
+    "robodev": "^0.37.1",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }