opencode-dashboard-server 0.1.0__tar.gz

opencode_dashboard_server-0.1.0/PKG-INFO

@@ -0,0 +1,8 @@
+Metadata-Version: 2.4
+Name: opencode-dashboard-server
+Version: 0.1.0
+Summary: FastAPI aggregator over opencode's SQLite storage
+Project-URL: Homepage, https://github.com/GCS-ZHN/opencode-dashboard
+Requires-Python: >=3.10
+Requires-Dist: fastapi<1,>=0.115
+Requires-Dist: uvicorn<1,>=0.30

opencode_dashboard_server-0.1.0/aggregate.py

@@ -0,0 +1,228 @@
+"""SQL + aggregation over the opencode storage, mirroring the proven logic in
+~/Downloads/export_token_usage.py.
+
+Project/session rollups come from the `session` table's denormalized token/cost
+columns; per-model breakdowns aggregate `message.data` JSON. All values are
+returned as integers/floats, never null (missing = 0).
+"""
+
+import json
+from pathlib import Path
+
+# token keys as emitted in API output -> session table column
+TOKEN_COLS = ("input", "output", "reasoning", "cache_read", "cache_write")
+SESS_COL = {
+    "input": "tokens_input",
+    "output": "tokens_output",
+    "reasoning": "tokens_reasoning",
+    "cache_read": "tokens_cache_read",
+    "cache_write": "tokens_cache_write",
+}
+
+# column order of the per-message TSV pull (must match MESSAGES_SQL select list)
+_MSG_KEYS = [
+    "model_id", "provider", "mode", "message_count",
+    "tokens_input", "tokens_output", "tokens_reasoning",
+    "tokens_cache_read", "tokens_cache_write", "cost",
+]
+
+# Effective grouping key: real projects (worktree != "/") group by project_id;
+# the catch-all "global" project (worktree "/") holds sessions from many folders,
+# so split it by session.directory — otherwise unrelated sessions get misattributed.
+# Directory groups use hex(directory) so the id is URL-safe (a raw path contains
+# "/" which would split the FastAPI route segment and 404).
+EFF_SQL = """
+CASE WHEN p.worktree IS NOT NULL AND p.worktree != '/' THEN s.project_id
+     ELSE 'dir:' || lower(hex(COALESCE(s.directory, ''))) END
+"""
+
+# Join + effective-key mapping live in a derived table so `id`/`worktree` are
+# unambiguous result columns (s.id and p.id would otherwise clash in GROUP BY).
+ROLLUP_SQL = f"""
+SELECT gid AS id,
+       MAX(worktree) AS worktree,
+       COUNT(*) AS session_count,
+       COUNT(DISTINCT CASE
+           WHEN eff.parent_id IS NULL
+             OR NOT EXISTS (SELECT 1 FROM session p2 WHERE p2.id = eff.parent_id)
+           THEN eff.sid END) AS main_session_count,
+       COUNT(DISTINCT gid) AS project_count,
+       COALESCE(SUM(cost), 0) AS cost,
+       COALESCE(SUM(tokens_input), 0) AS tokens_input,
+       COALESCE(SUM(tokens_output), 0) AS tokens_output,
+       COALESCE(SUM(tokens_reasoning), 0) AS tokens_reasoning,
+       COALESCE(SUM(tokens_cache_read), 0) AS tokens_cache_read,
+       COALESCE(SUM(tokens_cache_write), 0) AS tokens_cache_write
+FROM (
+    SELECT s.project_id, s.id AS sid, s.parent_id, s.cost, s.tokens_input,
+           s.tokens_output, s.tokens_reasoning, s.tokens_cache_read,
+           s.tokens_cache_write,
+           {EFF_SQL} AS gid,
+           CASE WHEN p.worktree IS NOT NULL AND p.worktree != '/' THEN p.worktree
+                ELSE s.directory END AS worktree
+    FROM session s
+    LEFT JOIN project p ON p.id = s.project_id
+) AS eff
+"""
+
+SESSIONS_SQL = """
+SELECT id, parent_id, project_id, title, agent, model, cost,
+       tokens_input, tokens_output, tokens_reasoning, tokens_cache_read,
+       tokens_cache_write, time_created, time_updated
+FROM session
+"""
+
+PROJECT_SESSIONS_SQL = f"""
+SELECT s.id, s.parent_id, s.project_id, s.title, s.agent, s.model, s.cost,
+       s.tokens_input, s.tokens_output, s.tokens_reasoning, s.tokens_cache_read,
+       s.tokens_cache_write, s.time_created, s.time_updated
+FROM session s
+LEFT JOIN project p ON p.id = s.project_id
+WHERE {EFF_SQL} = ?
+ORDER BY s.cost DESC, s.id ASC
+"""
+
+MESSAGES_SQL = """
+SELECT json_extract(data, '$.modelID') AS model_id,
+       json_extract(data, '$.providerID') AS provider,
+       json_extract(data, '$.mode') AS mode,
+       COUNT(*) AS message_count,
+       COALESCE(SUM(json_extract(data, '$.tokens.input')), 0) AS tokens_input,
+       COALESCE(SUM(json_extract(data, '$.tokens.output')), 0) AS tokens_output,
+       COALESCE(SUM(json_extract(data, '$.tokens.reasoning')), 0) AS tokens_reasoning,
+       COALESCE(SUM(json_extract(data, '$.tokens.cache.read')), 0) AS tokens_cache_read,
+       COALESCE(SUM(json_extract(data, '$.tokens.cache.write')), 0) AS tokens_cache_write,
+       COALESCE(SUM(json_extract(data, '$.cost')), 0) AS cost
+FROM message
+WHERE json_extract(data, '$.role') = 'assistant'
+  AND json_extract(data, '$.tokens') IS NOT NULL
+"""
+
+
+def normalize_model(mid) -> str | None:
+    """Strip a provider prefix if present: deepseek/deepseek-v4-flash -> deepseek-v4-flash."""
+    if not mid:
+        return mid
+    return str(mid).rsplit("/", 1)[-1]
+
+
+def session_model_id(raw) -> str | None:
+    """`session.model` is a JSON object string like
+    {"id":"deepseek-v4-flash","providerID":"deepseek",...} — extract the id.
+    Falls back to the raw string (older/plain values) with the prefix stripped."""
+    if not raw:
+        return None
+    s = str(raw).strip()
+    if s.startswith("{"):
+        try:
+            return normalize_model(json.loads(s).get("id") or None)
+        except ValueError:
+            pass
+    return normalize_model(s)
+
+
+def tokens(row) -> dict:
+    """Build the API tokens object from a row carrying tokens_* columns."""
+    t = {k: int(row.get(SESS_COL[k]) or 0) for k in TOKEN_COLS}
+    return {
+        "input": t["input"],
+        "output": t["output"],
+        "reasoning": t["reasoning"],
+        "cacheRead": t["cache_read"],
+        "cacheWrite": t["cache_write"],
+        "total": sum(t.values()),
+    }
+
+
+def _project(r) -> dict:
+    worktree = r["worktree"] or ""
+    name = Path(worktree).name or "(unknown)"
+    return {
+        "id": r["id"],
+        "name": name,
+        "worktree": worktree,
+        "sessionCount": int(r["session_count"] or 0),
+        "mainSessionCount": int(r["main_session_count"] or 0),
+        "tokens": tokens(r),
+        "cost": round(float(r["cost"] or 0), 6),
+    }
+
+
+def _session(r) -> dict:
+    return {
+        "id": r["id"],
+        "parentId": r["parent_id"],
+        "projectId": r["project_id"],
+        "title": r["title"],
+        "agent": r["agent"],
+        "model": session_model_id(r["model"]),
+        "timeCreated": int(r["time_created"] or 0),
+        "timeUpdated": int(r["time_updated"] or 0),
+        "tokens": tokens(r),
+        "cost": round(float(r["cost"] or 0), 6),
+    }
+
+
+def updated_at(runner) -> int:
+    """max time_updated across session + message (stream poll signal)."""
+    row = runner.query(
+        "SELECT MAX(m) AS m FROM ("
+        "  SELECT MAX(time_updated) AS m FROM session"
+        "  UNION ALL"
+        "  SELECT MAX(time_updated) AS m FROM message)"
+    )[0]
+    return int(row["m"] or 0)
+
+
+def overview(runner) -> dict:
+    r = runner.query(ROLLUP_SQL)[0]
+    return {
+        "projectCount": int(r["project_count"] or 0),
+        "sessionCount": int(r["session_count"] or 0),
+        "mainSessionCount": int(r["main_session_count"] or 0),
+        "tokens": tokens(r),
+        "cost": round(float(r["cost"] or 0), 6),
+        "updatedAt": updated_at(runner),
+    }
+
+
+def projects(runner) -> list[dict]:
+    rows = runner.query(
+        ROLLUP_SQL + " GROUP BY id, worktree"
+        " ORDER BY cost DESC, id ASC"
+    )
+    return [_project(r) for r in rows]
+
+
+def project_detail(runner, project_id) -> tuple[dict, list[dict]] | None:
+    rows = runner.query(
+        ROLLUP_SQL + " GROUP BY id, worktree HAVING id = ?",
+        (project_id,),
+    )
+    if not rows:
+        return None
+    sessions = runner.query(PROJECT_SESSIONS_SQL, (project_id,))
+    return _project(rows[0]), [_session(r) for r in sessions]
+
+
+def session_detail(runner, session_id) -> tuple[dict, list[dict]] | None:
+    rows = runner.query(SESSIONS_SQL + " WHERE id = ?", (session_id,))
+    if not rows:
+        return None
+    msg_rows = runner.query_tsv(
+        MESSAGES_SQL + " AND session_id = ? GROUP BY model_id, provider, mode",
+        (session_id,),
+    )
+    models = []
+    for row in msg_rows:
+        d = dict(zip(_MSG_KEYS, row))
+        models.append({
+            "model": normalize_model(d["model_id"]),
+            "provider": d["provider"],
+            "mode": d["mode"],
+            "messageCount": int(d["message_count"] or 0),
+            "tokens": tokens(d),
+            "cost": round(float(d["cost"] or 0), 6),
+        })
+    models.sort(key=lambda m: (-m["cost"], m["model"] or ""))
+    return _session(rows[0]), models

opencode_dashboard_server-0.1.0/app.py

@@ -0,0 +1,144 @@
+"""FastAPI app implementing the API.md contract over the opencode aggregator.
+
+Run:  uv run uvicorn app:app --reload
+"""
+
+import asyncio
+import json
+import logging
+import socket
+import subprocess
+from functools import lru_cache
+
+from fastapi import FastAPI, HTTPException
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import StreamingResponse
+
+import aggregate
+from db import CliRunner
+
+logger = logging.getLogger("dashboard")
+
+
+@lru_cache(maxsize=1)
+def opencode_version() -> str:
+    try:
+        return subprocess.run(
+            ["opencode", "--version"], capture_output=True, text=True, check=True
+        ).stdout.strip()
+    except (OSError, subprocess.CalledProcessError):
+        return "unknown"  # e.g. CI without the opencode CLI; don't fail the request
+
+
+def create_app(runner=None) -> FastAPI:
+    runner = runner or CliRunner()
+    app = FastAPI(title="opencode token dashboard")
+    # Loopback-only API; restrict origins so a random webpage can't exfiltrate
+    # local project/session data from the browser (the client runs from Vite).
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=[
+            "http://localhost:5173", "http://127.0.0.1:5173",
+            "http://localhost:4173", "http://127.0.0.1:4173",
+        ],
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
+    def handle(fn):
+        try:
+            return fn()
+        except HTTPException:
+            raise
+        except Exception:
+            logger.exception("aggregation failed")
+            raise HTTPException(500, detail="aggregation failed")
+
+    @app.get("/health")
+    def health():
+        return {"status": "ok", "version": opencode_version()}
+
+    @app.get("/overview")
+    def overview():
+        def run():
+            data = aggregate.overview(runner)
+            data["host"] = socket.gethostname()
+            data["opencodeVersion"] = opencode_version()
+            return data
+
+        return handle(run)
+
+    @app.get("/projects")
+    def projects():
+        return handle(lambda: aggregate.projects(runner))
+
+    @app.get("/projects/{project_id}")
+    def project(project_id: str):
+        def run():
+            res = aggregate.project_detail(runner, project_id)
+            if res is None:
+                raise HTTPException(404, detail=f"project {project_id} not found")
+            proj, sessions = res
+            return {"project": proj, "sessions": sessions}
+
+        return handle(run)
+
+    @app.get("/sessions/{session_id}")
+    def session(session_id: str):
+        def run():
+            res = aggregate.session_detail(runner, session_id)
+            if res is None:
+                raise HTTPException(404, detail=f"session {session_id} not found")
+            sess, models = res
+            return {"session": sess, "models": models}
+
+        return handle(run)
+
+    @app.get("/stream")
+    async def stream():
+        q: asyncio.Queue = asyncio.Queue()
+        stop = asyncio.Event()
+
+        async def poll():
+            loop = asyncio.get_running_loop()
+            last = None
+            ticks = 0
+            while not stop.is_set():
+                try:
+                    ts = await loop.run_in_executor(None, aggregate.updated_at, runner)
+                    if ts and ts != last:
+                        last = ts
+                        await q.put({"type": "updated", "at": ts, "scope": "overview"})
+                    else:
+                        ticks += 1
+                        if ticks % 3 == 0:  # heartbeat every ~15s (poll = 5s)
+                            await q.put({"type": "heartbeat"})
+                except Exception:
+                    logger.exception("stream poll failed")
+                try:
+                    await asyncio.wait_for(stop.wait(), 5)
+                except asyncio.TimeoutError:
+                    pass
+
+        task = asyncio.create_task(poll())
+        await q.put({"type": "heartbeat"})
+
+        async def gen():
+            try:
+                while True:
+                    payload = await q.get()
+                    data = json.dumps(payload)
+                    if payload["type"] == "updated":
+                        yield f"event: update\ndata: {data}\n\n"
+                    else:
+                        yield f"data: {data}\n\n"
+            finally:
+                stop.set()
+                task.cancel()
+
+        return StreamingResponse(gen(), media_type="text/event-stream")
+
+    return app
+
+
+app = create_app()

opencode_dashboard_server-0.1.0/db.py

@@ -0,0 +1,65 @@
+"""DB access layer for the opencode storage.
+
+Two interchangeable runners over the same SQL surface:
+
+- `CliRunner`: shells out to `opencode db "<SQL>" --format json|tsv`. JSON mode
+  yields typed numbers; TSV is used for the big `message` pulls (JSON output
+  blows up on tens of thousands of rows). Never opens the sqlite file directly
+  (opencode keeps it in WAL mode).
+- `SqliteRunner`: executes the same SQL on a `sqlite3.Connection` — used by
+  tests against an in-memory fixture replicating the opencode schema.
+"""
+
+import json
+import subprocess
+
+
+def _inline(sql: str, params: tuple) -> str:
+    """Inline bound params into SQL as safely-quoted literals (CliRunner has no
+    parameter binding; ids come from URL paths)."""
+    for p in params:
+        if p is None:
+            rep = "NULL"
+        elif isinstance(p, (int, float)):
+            rep = repr(p)
+        else:
+            rep = "'" + str(p).replace("'", "''") + "'"
+        sql = sql.replace("?", rep, 1)
+    return sql
+
+
+class CliRunner:
+    def __init__(self, executable: str = "opencode"):
+        self._cmd = [executable, "db"]
+
+    def query(self, sql: str, params: tuple = ()) -> list[dict]:
+        raw = subprocess.run(
+            [*self._cmd, _inline(sql, params), "--format", "json"],
+            capture_output=True, text=True, check=True,
+        ).stdout
+        return json.loads(raw) if raw.strip() else []
+
+    def query_tsv(self, sql: str, params: tuple = ()) -> list[list[str]]:
+        raw = subprocess.run(
+            [*self._cmd, _inline(sql, params), "--format", "tsv"],
+            capture_output=True, text=True, check=True,
+        ).stdout
+        lines = raw.strip().split("\n")
+        return [line.split("\t") for line in lines[1:]]  # skip header row
+
+
+class SqliteRunner:
+    def __init__(self, conn):
+        self._conn = conn
+
+    def query(self, sql: str, params: tuple = ()) -> list[dict]:
+        cur = self._conn.execute(sql, params)
+        cols = [d[0] for d in cur.description]
+        return [dict(zip(cols, row)) for row in cur.fetchall()]
+
+    def query_tsv(self, sql: str, params: tuple = ()) -> list[list[str]]:
+        cur = self._conn.execute(sql, params)
+        return [
+            ["" if v is None else v if isinstance(v, str) else str(v) for v in row]
+            for row in cur.fetchall()
+        ]

opencode_dashboard_server-0.1.0/opencode_dashboard_server.egg-info/PKG-INFO

@@ -0,0 +1,8 @@
+Metadata-Version: 2.4
+Name: opencode-dashboard-server
+Version: 0.1.0
+Summary: FastAPI aggregator over opencode's SQLite storage
+Project-URL: Homepage, https://github.com/GCS-ZHN/opencode-dashboard
+Requires-Python: >=3.10
+Requires-Dist: fastapi<1,>=0.115
+Requires-Dist: uvicorn<1,>=0.30

opencode_dashboard_server-0.1.0/opencode_dashboard_server.egg-info/SOURCES.txt

@@ -0,0 +1,11 @@
+aggregate.py
+app.py
+db.py
+pyproject.toml
+opencode_dashboard_server.egg-info/PKG-INFO
+opencode_dashboard_server.egg-info/SOURCES.txt
+opencode_dashboard_server.egg-info/dependency_links.txt
+opencode_dashboard_server.egg-info/requires.txt
+opencode_dashboard_server.egg-info/top_level.txt
+tests/test_aggregate.py
+tests/test_app.py

opencode_dashboard_server-0.1.0/opencode_dashboard_server.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

opencode_dashboard_server-0.1.0/opencode_dashboard_server.egg-info/requires.txt

@@ -0,0 +1,2 @@
+fastapi<1,>=0.115
+uvicorn<1,>=0.30

opencode_dashboard_server-0.1.0/opencode_dashboard_server.egg-info/top_level.txt

@@ -0,0 +1,3 @@
+aggregate
+app
+db

opencode_dashboard_server-0.1.0/pyproject.toml

@@ -0,0 +1,29 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "opencode-dashboard-server"
+version = "0.1.0"
+description = "FastAPI aggregator over opencode's SQLite storage"
+requires-python = ">=3.10"
+dependencies = [
+    "fastapi>=0.115,<1",
+    "uvicorn>=0.30,<1",
+]
+
+[project.urls]
+Homepage = "https://github.com/GCS-ZHN/opencode-dashboard"
+
+[tool.setuptools]
+py-modules = ["app", "aggregate", "db"]
+
+[dependency-groups]
+dev = [
+    "httpx>=0.27,<1",
+    "pytest>=8,<10",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["."]

opencode_dashboard_server-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

opencode_dashboard_server-0.1.0/tests/test_aggregate.py

@@ -0,0 +1,116 @@
+"""Assert-based tests for the aggregation logic, driven via SqliteRunner."""
+
+from aggregate import (
+    normalize_model,
+    overview,
+    project_detail,
+    projects,
+    session_detail,
+)
+
+ZERO_TOKENS = {"input": 0, "output": 0, "reasoning": 0,
+               "cacheRead": 0, "cacheWrite": 0, "total": 0}
+
+DIR_DASH = "dir:" + b"/Users/test/projects/opencode-dashboard".hex()
+DIR_TMP = "dir:" + b"/private/tmp".hex()
+
+
+def test_overview_rollup(runner):
+    o = overview(runner)
+    assert o["projectCount"] == 5
+    assert o["sessionCount"] == 8
+    assert o["mainSessionCount"] == 7  # s3 is the only subagent
+    assert o["cost"] == 7.4
+    assert o["tokens"] == {"input": 4100, "output": 1980, "reasoning": 900,
+                           "cacheRead": 350, "cacheWrite": 173, "total": 7503}
+    assert o["updatedAt"] == 190000
+
+
+def test_projects_ordered_by_cost_desc(runner):
+    ps = projects(runner)
+    assert [p["id"] for p in ps] == [
+        "proj-ccc", "proj-aaa", "proj-bbb", DIR_DASH, DIR_TMP,
+    ]
+    p1 = ps[1]
+    assert p1["name"] == "dash"
+    assert p1["worktree"] == "/Users/test/projects/dash"
+    assert p1["sessionCount"] == 3
+    assert p1["mainSessionCount"] == 2  # s1, s2 roots; s3 is s1's subagent
+    assert p1["cost"] == 2.7
+    assert p1["tokens"]["input"] == 1400
+    assert p1["tokens"]["total"] == 1400 + 650 + 270 + 115 + 57
+
+
+def test_global_catchall_sessions_split_by_directory(runner):
+    ps = {p["id"]: p for p in projects(runner)}
+    dash = ps[DIR_DASH]
+    tmp = ps[DIR_TMP]
+    assert dash["name"] == "opencode-dashboard"
+    assert dash["sessionCount"] == 1  # only s8, not the tmp/home sessions
+    assert dash["cost"] == 0.2
+    assert tmp["name"] == "tmp"
+    assert tmp["sessionCount"] == 1  # only s7
+    assert tmp["cost"] == 0.1
+    assert "global" not in ps  # catch-all bucket itself is never shown as a project
+
+
+def test_global_dir_group_detail(runner):
+    proj, sessions = project_detail(runner, DIR_TMP)
+    assert proj["name"] == "tmp"
+    assert [s["id"] for s in sessions] == ["s7"]
+
+
+def test_project_detail_flat_sessions(runner):
+    proj, sessions = project_detail(runner, "proj-aaa")
+    assert proj["name"] == "dash"
+    assert [s["id"] for s in sessions] == ["s1", "s2", "s3"]
+    by_id = {s["id"]: s for s in sessions}
+    assert by_id["s1"]["parentId"] is None
+    assert by_id["s3"]["parentId"] == "s1"
+    assert by_id["s1"]["model"] == "deepseek-v4-flash"
+    assert by_id["s1"]["tokens"]["total"] == 1000 + 500 + 200 + 100 + 50
+
+
+def test_session_detail_model_breakdown(runner):
+    sess, models = session_detail(runner, "s4")
+    assert sess["cost"] == 0.9
+    assert [m["model"] for m in models] == ["deepseek-v4-flash", "claude-sonnet-4.5"]
+    flash = models[0]
+    assert flash["provider"] == "deepseek"
+    assert flash["mode"] == "build"
+    assert flash["messageCount"] == 2
+    assert flash["tokens"] == {"input": 200, "output": 100, "reasoning": 50,
+                               "cacheRead": 20, "cacheWrite": 10, "total": 380}
+    assert flash["cost"] == 0.6
+    claude = models[1]
+    assert claude["messageCount"] == 1
+    assert claude["tokens"] == {"input": 200, "output": 100, "reasoning": 50,
+                                "cacheRead": 0, "cacheWrite": 0, "total": 350}
+    assert claude["cost"] == 0.3
+
+
+def test_zero_token_session_is_zeros_not_null(runner):
+    sess, models = session_detail(runner, "s5")
+    assert sess["cost"] == 0.0
+    assert sess["tokens"] == ZERO_TOKENS
+    assert len(models) == 1
+    assert models[0]["tokens"] == ZERO_TOKENS
+    assert models[0]["cost"] == 0.0
+    assert models[0]["messageCount"] == 1
+
+
+def test_session_without_messages_has_empty_models(runner):
+    sess, models = session_detail(runner, "s6")
+    assert sess["model"] == "deepseek-v4-pro"  # provider prefix stripped
+    assert models == []
+
+
+def test_normalize_model():
+    assert normalize_model("deepseek/deepseek-v4-flash") == "deepseek-v4-flash"
+    assert normalize_model("deepseek-v4-flash") == "deepseek-v4-flash"
+    assert normalize_model(None) is None
+
+
+def test_unknown_ids_return_none(runner):
+    assert project_detail(runner, "nope") is None
+    assert session_detail(runner, "nope") is None

opencode_dashboard_server-0.1.0/tests/test_app.py

@@ -0,0 +1,48 @@
+"""HTTP-level smoke tests + the SQL-inlining boundary (CliRunner's only injection
+surface). Driven via create_app(SqliteRunner) over the in-memory fixture, so no
+`opencode db` CLI spawn happens."""
+
+import sqlite3
+
+from fastapi.testclient import TestClient
+
+import app as appmod
+from db import SqliteRunner, _inline
+from tests.conftest import SCHEMA, seed
+
+
+def make_client() -> TestClient:
+    conn = sqlite3.connect(":memory:", check_same_thread=False)
+    conn.executescript(SCHEMA)
+    seed(conn)
+    return TestClient(appmod.create_app(SqliteRunner(conn))), conn
+
+
+def test_inline_quotes_and_escapes():
+    sql = _inline("WHERE id = ? AND cost > ?", ("a'b\";\nDROP", 5))
+    assert sql == "WHERE id = 'a''b\";\nDROP' AND cost > 5"
+    assert 'DROP' in sql  # payload stays inside one quoted literal
+
+
+def test_unknown_project_404():
+    c, _ = make_client()
+    r = c.get("/projects/nope")
+    assert r.status_code == 404
+    assert r.json() == {"detail": "project nope not found"}
+
+
+def test_overview_keys():
+    c, _ = make_client()
+    r = c.get("/overview")
+    assert r.status_code == 200
+    assert {"host", "opencodeVersion", "projectCount", "sessionCount",
+            "tokens", "cost", "updatedAt"} <= set(r.json())
+
+
+def test_foreign_origin_not_allowed_by_cors():
+    c, _ = make_client()
+    r = c.options("/projects", headers={
+        "Origin": "https://evil.example",
+        "Access-Control-Request-Method": "GET",
+    })
+    assert "access-control-allow-origin" not in r.headers