shipwright-cli 3.1.0 → 3.3.0

package/dashboard/server.ts

@@ -41,6 +41,10 @@ const SESSION_SECRET = process.env.SESSION_SECRET || crypto.randomUUID();
 const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 const ALLOWED_PERMISSIONS = ["admin", "write"];
 
+// ─── WebSocket Security ──────────────────────────────────────────────
+const MAX_WS_CLIENTS = 50;
+const WS_CONNECTION_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes
+
 // ─── SQLite Database (optional) ──────────────────────────────────────
 const DB_FILE = join(HOME, ".shipwright", "shipwright.db");
 let db: Database | null = null;
@@ -333,6 +337,15 @@ function sessionCookie(sessionId: string): string {
   return `fleet_session=${sessionId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${Math.floor(SESSION_TTL_MS / 1000)}`;
 }
 
+function isLocalConnection(req: Request): boolean {
+  const host = req.headers.get("host") || "";
+  return (
+    host.startsWith("localhost:") ||
+    host.startsWith("127.0.0.1:") ||
+    host.startsWith("[::1]:")
+  );
+}
+
 function clearSessionCookie(): string {
   return "fleet_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0";
 }
@@ -932,18 +945,19 @@ function broadcastNewEvents(): void {
 }
 
 // ─── Data Collection ─────────────────────────────────────────────────
-function readEvents(): DaemonEvent[] {
+function readEvents(limit = 200): DaemonEvent[] {
   // Try SQLite first (faster for large event logs)
-  const dbEvents = dbQueryEvents(0, 10000);
+  const dbEvents = dbQueryEvents(0, limit);
   if (dbEvents.length > 0) return dbEvents;
 
-  // Fallback to JSONL
+  // Fallback to JSONL — only read last 1000 lines to avoid OOM on large files
   if (!existsSync(EVENTS_FILE)) return [];
   try {
     const content = readFileSync(EVENTS_FILE, "utf-8").trim();
     if (!content) return [];
-    return content
-      .split("\n")
+    const lines = content.split("\n");
+    const recent = lines.length > 1000 ? lines.slice(-1000) : lines;
+    return recent
       .filter((l) => l.trim())
       .map((l) => {
         try {
@@ -2204,6 +2218,12 @@ function ghCached<T>(key: string, fn: () => T): T {
   const now = Date.now();
   const cached = ghCache.get(key);
   if (cached && now - cached.ts < GH_CACHE_TTL_MS) return cached.data as T;
+  // Evict expired entries to prevent unbounded memory growth
+  if (ghCache.size > 50) {
+    for (const [k, v] of ghCache) {
+      if (now - v.ts > GH_CACHE_TTL_MS) ghCache.delete(k);
+    }
+  }
   const data = fn();
   ghCache.set(key, { data, ts: now });
   return data;
@@ -2689,15 +2709,43 @@ const server = Bun.serve({
       return handleAuthLogout(req);
     }
 
-    // ── Auth gate ─────────────────────────────────────────────────
-    // If auth is enabled, enforce it on all remaining routes
+    // ── WebSocket Auth gate ──────────────────────────────────────
+    // WebSocket always requires authentication (unless local connection)
+    if (pathname === "/ws" || pathname === "/ws/events") {
+      const isLocal = isLocalConnection(req);
+      if (!isLocal) {
+        const session = getSession(req);
+        if (!session) {
+          return new Response("Unauthorized", { status: 401 });
+        }
+      }
+
+      // Check connection limit
+      const totalClients = wsClients.size + eventClients.size;
+      if (totalClients >= MAX_WS_CLIENTS && !isLocal) {
+        return new Response("Too Many Connections", { status: 429 });
+      }
+
+      // WebSocket upgrade — /ws/events streams raw events, /ws streams aggregated state
+      if (pathname === "/ws/events") {
+        const upgraded = server.upgrade(req, {
+          data: { type: "events", lastEventId: 0 },
+        });
+        if (upgraded) return undefined as unknown as Response;
+        return new Response("WebSocket upgrade failed", { status: 400 });
+      }
+      if (pathname === "/ws") {
+        const upgraded = server.upgrade(req);
+        if (upgraded) return undefined as unknown as Response;
+        return new Response("WebSocket upgrade failed", { status: 400 });
+      }
+    }
+
+    // ── HTTP Auth gate ───────────────────────────────────────────
+    // If auth is enabled, enforce it on all other remaining routes
     if (isAuthEnabled()) {
       const session = getSession(req);
       if (!session) {
-        // WebSocket upgrade attempt without auth
-        if (pathname === "/ws" || pathname === "/ws/events") {
-          return new Response("Unauthorized", { status: 401 });
-        }
         return new Response(null, {
           status: 302,
           headers: { Location: "/login" },
@@ -2707,20 +2755,6 @@ const server = Bun.serve({
 
     // ── Protected routes ──────────────────────────────────────────
 
-    // WebSocket upgrade — /ws/events streams raw events, /ws streams aggregated state
-    if (pathname === "/ws/events") {
-      const upgraded = server.upgrade(req, {
-        data: { type: "events", lastEventId: 0 },
-      });
-      if (upgraded) return undefined as unknown as Response;
-      return new Response("WebSocket upgrade failed", { status: 400 });
-    }
-    if (pathname === "/ws") {
-      const upgraded = server.upgrade(req);
-      if (upgraded) return undefined as unknown as Response;
-      return new Response("WebSocket upgrade failed", { status: 400 });
-    }
-
     // REST: fleet state
     if (pathname === "/api/status") {
       return new Response(JSON.stringify(getFleetState()), {
@@ -3690,6 +3724,57 @@ const server = Bun.serve({
       });
     }
 
+    // REST: Context efficiency metrics (from loop.context_efficiency events)
+    if (pathname === "/api/context-efficiency") {
+      const period = parseInt(url.searchParams.get("period") || "7");
+      const events = readEvents();
+      const now = Math.floor(Date.now() / 1000);
+      const cutoff = now - period * 86400;
+
+      let totalUtil = 0;
+      let totalRatio = 0;
+      let totalRaw = 0;
+      let totalTrimmed = 0;
+      let trimEvents = 0;
+      let count = 0;
+
+      for (const e of events) {
+        if ((e.ts_epoch || 0) < cutoff) continue;
+        if (e.type !== "loop.context_efficiency") continue;
+
+        const util = parseFloat(String(e.budget_utilization || 0));
+        const ratio = parseFloat(String(e.trim_ratio || 0));
+        const raw = parseInt(String(e.raw_prompt_chars || 0), 10);
+        const trimmed = parseInt(String(e.trimmed_prompt_chars || 0), 10);
+
+        totalUtil += util;
+        totalRatio += ratio;
+        totalRaw += raw;
+        totalTrimmed += trimmed;
+        if (ratio > 0) trimEvents++;
+        count++;
+      }
+
+      const avgUtilization =
+        count > 0 ? Math.round((totalUtil / count) * 10) / 10 : 0;
+      const avgTrimRatio =
+        count > 0 ? Math.round((totalRatio / count) * 10) / 10 : 0;
+      const totalDiscarded = totalRaw - totalTrimmed;
+
+      return new Response(
+        JSON.stringify({
+          avg_utilization: avgUtilization,
+          avg_trim_ratio: avgTrimRatio,
+          total_raw_chars: totalRaw,
+          total_trimmed_chars: totalTrimmed,
+          total_discarded_chars: totalDiscarded,
+          trim_events: trimEvents,
+          total_iterations: count,
+        }),
+        { headers: { "Content-Type": "application/json", ...CORS_HEADERS } },
+      );
+    }
+
     // REST: DORA trend (weekly sliding windows)
     if (pathname === "/api/metrics/dora-trend") {
       const period = parseInt(url.searchParams.get("period") || "30");
@@ -5846,6 +5931,13 @@ process.on("SIGINT", () => {
   clearInterval(staleClaimInterval);
   clearInterval(inviteCleanupInterval);
   if (eventsWatcher) eventsWatcher.close();
+  if (db) {
+    try {
+      db.close();
+    } catch {
+      /* ignore */
+    }
+  }
   for (const ws of wsClients) {
     try {
       ws.close(1001, "Server shutting down");

package/dashboard/services/config.ts

@@ -0,0 +1,26 @@
+// Centralized configuration for dashboard services
+import { join } from "path";
+
+const HOME = process.env.HOME || "";
+
+export const config = {
+  port: parseInt(
+    process.argv[2] || process.env.SHIPWRIGHT_DASHBOARD_PORT || "8767",
+  ),
+  home: HOME,
+  eventsFile: join(HOME, ".shipwright", "events.jsonl"),
+  daemonState: join(HOME, ".shipwright", "daemon-state.json"),
+  logsDir: join(HOME, ".shipwright", "logs"),
+  heartbeatDir: join(HOME, ".shipwright", "heartbeats"),
+  machinesFile: join(HOME, ".shipwright", "machines.json"),
+  costsFile: join(HOME, ".shipwright", "costs.json"),
+  budgetFile: join(HOME, ".shipwright", "budget.json"),
+  memoryDir: join(HOME, ".shipwright", "memory"),
+  publicDir: join(import.meta.dir, "../public"),
+  dbFile: join(HOME, ".shipwright", "shipwright.db"),
+  sessionsFile: join(HOME, ".shipwright", "sessions.json"),
+  developerRegistryFile: join(HOME, ".shipwright", "developer-registry.json"),
+  teamEventsFile: join(HOME, ".shipwright", "team-events.jsonl"),
+  inviteTokensFile: join(HOME, ".shipwright", "invite-tokens.json"),
+  notificationsConfigFile: join(HOME, ".shipwright", "notifications.json"),
+};

package/dashboard/services/db.ts

@@ -0,0 +1,118 @@
+import { Database } from "bun:sqlite";
+import { existsSync } from "fs";
+import { config } from "./config.js";
+import type { DaemonEvent } from "../types/index.js";
+
+let db: Database | null = null;
+
+export function getDb(): Database | null {
+  if (db) return db;
+  try {
+    if (!existsSync(config.dbFile)) return null;
+    db = new Database(config.dbFile, { readonly: true });
+    db.exec("PRAGMA journal_mode=WAL;");
+    return db;
+  } catch {
+    return null;
+  }
+}
+
+export function dbQueryEventsByIdGreaterThan(
+  afterId: number,
+  limit = 100,
+): Array<Record<string, unknown>> {
+  const conn = getDb();
+  if (!conn) return [];
+  try {
+    return conn
+      .query(`SELECT * FROM events WHERE id > ? ORDER BY id ASC LIMIT ?`)
+      .all(afterId, limit) as Array<Record<string, unknown>>;
+  } catch {
+    return [];
+  }
+}
+
+export function dbQueryEvents(since?: number, limit = 200): DaemonEvent[] {
+  const conn = getDb();
+  if (!conn) return [];
+  try {
+    const cutoff = since || 0;
+    const rows = conn
+      .query(
+        `SELECT ts, ts_epoch, type, job_id, stage, status, duration_secs, metadata
+         FROM events WHERE ts_epoch >= ? ORDER BY ts_epoch DESC LIMIT ?`,
+      )
+      .all(cutoff, limit) as Array<Record<string, unknown>>;
+    return rows.map((r) => {
+      const base: DaemonEvent = {
+        ts: r.ts as string,
+        ts_epoch: r.ts_epoch as number,
+        type: r.type as string,
+      };
+      if (r.job_id)
+        base.issue = parseInt(String(r.job_id).replace(/\D/g, "")) || undefined;
+      if (r.stage) base.stage = r.stage as string;
+      if (r.duration_secs) base.duration_s = r.duration_secs as number;
+      if (r.status) base.result = r.status as string;
+      if (r.metadata) {
+        try {
+          Object.assign(base, JSON.parse(r.metadata as string));
+        } catch {
+          /* ignore malformed metadata */
+        }
+      }
+      return base;
+    });
+  } catch {
+    return [];
+  }
+}
+
+export function dbQueryJobs(status?: string): Array<Record<string, unknown>> {
+  const conn = getDb();
+  if (!conn) return [];
+  try {
+    if (status) {
+      return conn
+        .query(
+          "SELECT * FROM daemon_state WHERE status = ? ORDER BY started_at DESC",
+        )
+        .all(status) as Array<Record<string, unknown>>;
+    }
+    return conn
+      .query("SELECT * FROM daemon_state ORDER BY started_at DESC LIMIT 50")
+      .all() as Array<Record<string, unknown>>;
+  } catch {
+    return [];
+  }
+}
+
+export function dbQueryCostsToday(): { total: number; count: number } {
+  const conn = getDb();
+  if (!conn) return { total: 0, count: 0 };
+  try {
+    const todayStart = new Date();
+    todayStart.setUTCHours(0, 0, 0, 0);
+    const epoch = Math.floor(todayStart.getTime() / 1000);
+    const row = conn
+      .query(
+        "SELECT COALESCE(SUM(cost_usd), 0) as total, COUNT(*) as count FROM cost_entries WHERE ts_epoch >= ?",
+      )
+      .get(epoch) as { total: number; count: number } | null;
+    return row || { total: 0, count: 0 };
+  } catch {
+    return { total: 0, count: 0 };
+  }
+}
+
+export function dbQueryHeartbeats(): Array<Record<string, unknown>> {
+  const conn = getDb();
+  if (!conn) return [];
+  try {
+    return conn
+      .query("SELECT * FROM heartbeats ORDER BY updated_at DESC")
+      .all() as Array<Record<string, unknown>>;
+  } catch {
+    return [];
+  }
+}

package/dashboard/src/canvas/pixel-agent.ts

@@ -0,0 +1,298 @@
+// Pixel Agent State Machine — Submarine crew members animated across compartments
+
+import type { StageName } from "../design/tokens";
+import type { CrewRole } from "../design/submarine-theme";
+import { timing } from "../design/submarine-theme";
+import { crewRoleForStage } from "../design/submarine-theme";
+import type { SubmarineLayout } from "./submarine-layout";
+
+// ── Types ────────────────────────────────────────────────────────────────────
+
+export type AgentState =
+  | "spawn"
+  | "idle"
+  | "walk"
+  | "working"
+  | "alert"
+  | "despawn";
+
+export type SpriteAction = "idle" | "walk" | "work" | "alert";
+
+// ── PixelAgent class ────────────────────────────────────────────────────────
+
+export class PixelAgent {
+  // Identity
+  issue: number;
+  stage: StageName;
+  role: CrewRole;
+
+  // Position & movement
+  x: number;
+  y: number;
+  targetX: number;
+  targetY: number;
+  direction: "left" | "right" = "right";
+  path: Point[] = [];
+  pathIndex: number = 0;
+
+  // Animation state
+  state: AgentState = "spawn";
+  stateTime: number = 0;
+  frameIndex: number = 0;
+  frameTimer: number = 0;
+
+  // Spawn/despawn progress (0-1)
+  spawnProgress: number = 0;
+
+  // Idle behavior
+  idleBobOffset: number = 0;
+  nextWanderTime: number = 0;
+
+  // Pipeline data
+  elapsed_s: number = 0;
+  iteration: number = 0;
+  status: string = "idle";
+
+  constructor(
+    issue: number,
+    stage: StageName,
+    role: CrewRole,
+    x: number,
+    y: number,
+  ) {
+    this.issue = issue;
+    this.stage = stage;
+    this.role = role;
+    this.x = x;
+    this.y = y;
+    this.targetX = x;
+    this.targetY = y;
+    this.nextWanderTime =
+      Math.random() * (timing.idleWanderRange[1] - timing.idleWanderRange[0]) +
+      timing.idleWanderRange[0];
+  }
+
+  update(dt: number, layout: SubmarineLayout): void {
+    this.stateTime += dt;
+    this.frameTimer += dt;
+
+    switch (this.state) {
+      case "spawn":
+        this.spawnProgress = Math.min(
+          1,
+          this.spawnProgress + dt / timing.spawnDuration,
+        );
+        if (this.spawnProgress >= 1) {
+          this.state = "idle";
+          this.stateTime = 0;
+        }
+        break;
+
+      case "idle":
+        this.updateIdleState(dt, layout);
+        break;
+
+      case "walk":
+        this.updateWalkState(dt);
+        break;
+
+      case "working":
+        this.updateWorkingState(dt);
+        break;
+
+      case "alert":
+        this.updateAlertState(dt);
+        break;
+
+      case "despawn":
+        this.spawnProgress = Math.max(
+          0,
+          this.spawnProgress - dt / timing.despawnDuration,
+        );
+        break;
+    }
+  }
+
+  private updateIdleState(dt: number, layout: SubmarineLayout): void {
+    // Idle bob animation
+    const bobFreq = (2 * Math.PI) / timing.idleBobPeriod;
+    this.idleBobOffset =
+      Math.sin(this.stateTime * bobFreq) * timing.idleBobAmplitude;
+
+    // Advance idle frame
+    const idleFrameInterval = 0.5;
+    if (this.frameTimer >= idleFrameInterval) {
+      this.frameIndex = (this.frameIndex + 1) % 2;
+      this.frameTimer = 0;
+    }
+
+    // Occasional wander
+    this.nextWanderTime -= dt;
+    if (this.nextWanderTime <= 0) {
+      const wanderDistance = 20;
+      const wanderX = this.x + (Math.random() - 0.5) * wanderDistance;
+      const wanderY = this.y + (Math.random() - 0.5) * wanderDistance;
+      this.targetX = wanderX;
+      this.targetY = wanderY;
+
+      this.nextWanderTime =
+        Math.random() *
+          (timing.idleWanderRange[1] - timing.idleWanderRange[0]) +
+        timing.idleWanderRange[0];
+    }
+  }
+
+  private updateWalkState(dt: number): void {
+    if (this.path.length === 0) {
+      this.state = "working";
+      this.stateTime = 0;
+      this.frameIndex = 0;
+      this.frameTimer = 0;
+      return;
+    }
+
+    const target = this.path[this.pathIndex];
+    const dx = target.x - this.x;
+    const dy = target.y - this.y;
+    const distance = Math.sqrt(dx * dx + dy * dy);
+
+    // Update direction
+    if (dx !== 0) {
+      this.direction = dx > 0 ? "right" : "left";
+    }
+
+    if (distance < 2) {
+      // Reached waypoint, move to next
+      this.pathIndex++;
+      if (this.pathIndex >= this.path.length) {
+        this.x = target.x;
+        this.y = target.y;
+        this.state = "working";
+        this.stateTime = 0;
+        this.frameIndex = 0;
+        this.frameTimer = 0;
+      }
+      return;
+    }
+
+    // Move toward target
+    const moveDistance = Math.min(distance, timing.walkSpeed * dt);
+    const moveRatio = moveDistance / distance;
+    this.x += dx * moveRatio;
+    this.y += dy * moveRatio;
+
+    // Advance walk frame
+    const walkFrameInterval = 0.15;
+    if (this.frameTimer >= walkFrameInterval) {
+      this.frameIndex = (this.frameIndex + 1) % 4;
+      this.frameTimer = 0;
+    }
+  }
+
+  private updateWorkingState(dt: number): void {
+    // Work animation: 2 frames at 0.3s interval
+    const workFrameInterval = timing.workFrameInterval;
+    if (this.frameTimer >= workFrameInterval) {
+      this.frameIndex = (this.frameIndex + 1) % 2;
+      this.frameTimer = 0;
+    }
+  }
+
+  private updateAlertState(dt: number): void {
+    // Alert flash: frame 0 for 0.4s, frame 1 for 0.4s
+    const flashInterval = timing.alertFlashInterval;
+    const cycle = (this.stateTime % (flashInterval * 2)) / flashInterval;
+    this.frameIndex = cycle < 1 ? 0 : 1;
+  }
+
+  moveTo(stage: StageName, layout: SubmarineLayout): void {
+    const targetComp = layout.getCompartment(stage);
+    if (!targetComp) return;
+
+    const currentComp = layout.getCompartment(this.stage);
+    if (!currentComp) return;
+
+    this.path = layout.getPathBetween(this.stage, stage);
+    if (this.path.length === 0) return;
+
+    this.stage = stage;
+    this.role = crewRoleForStage(stage);
+    this.targetX = targetComp.stationX;
+    this.targetY = targetComp.stationY;
+    this.pathIndex = 0;
+    this.state = "walk";
+    this.stateTime = 0;
+    this.frameIndex = 0;
+    this.frameTimer = 0;
+  }
+
+  setAlert(): void {
+    this.state = "alert";
+    this.stateTime = 0;
+    this.frameIndex = 0;
+    this.frameTimer = 0;
+  }
+
+  setDespawn(): void {
+    this.state = "despawn";
+    this.spawnProgress = 1;
+  }
+
+  syncFromPipeline(
+    pipeline: {
+      stage: string;
+      elapsed_s: number;
+      iteration: number;
+      status: string;
+    },
+    layout: SubmarineLayout,
+  ): void {
+    const newStage = pipeline.stage as StageName;
+    const stageChanged = this.stage !== newStage;
+
+    this.elapsed_s = pipeline.elapsed_s;
+    this.iteration = pipeline.iteration;
+    this.status = pipeline.status;
+
+    if (stageChanged) {
+      this.moveTo(newStage, layout);
+    }
+
+    if (pipeline.status === "failed") {
+      this.setAlert();
+    }
+  }
+
+  isDead(): boolean {
+    return this.state === "despawn" && this.spawnProgress <= 0;
+  }
+
+  getSpriteAction(): SpriteAction {
+    switch (this.state) {
+      case "spawn":
+      case "idle":
+        return "idle";
+      case "walk":
+        return "walk";
+      case "working":
+        return "work";
+      case "alert":
+      case "despawn":
+        return "alert";
+    }
+  }
+
+  getSpriteFrame(): number {
+    return this.frameIndex;
+  }
+
+  getDisplayY(): number {
+    return this.y + this.idleBobOffset;
+  }
+}
+
+// Re-export Point type from layout
+export interface Point {
+  x: number;
+  y: number;
+}