opencode-dashboard-server 0.4.0__tar.gz → 0.5.0__tar.gz

opencode_dashboard_server-0.5.0/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 GCS-ZHN
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{opencode_dashboard_server-0.4.0 → opencode_dashboard_server-0.5.0}/PKG-INFO

@@ -1,16 +1,19 @@
 Metadata-Version: 2.4
 Name: opencode-dashboard-server
-Version: 0.4.0
+Version: 0.5.0
 Summary: FastAPI aggregator over opencode's SQLite storage
+License-Expression: MIT
 Project-URL: Homepage, https://github.com/GCS-ZHN/opencode-dashboard
 Project-URL: Repository, https://github.com/GCS-ZHN/opencode-dashboard
 Project-URL: Issues, https://github.com/GCS-ZHN/opencode-dashboard/issues
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
+License-File: LICENSE.md
 Requires-Dist: fastapi<1,>=0.115
 Requires-Dist: uvicorn<1,>=0.30
 Requires-Dist: platformdirs<5,>=4
 Requires-Dist: PyYAML<7,>=6
+Dynamic: license-file
 
 # opencode-dashboard-server
 

{opencode_dashboard_server-0.4.0 → opencode_dashboard_server-0.5.0}/aggregate.py

@@ -38,7 +38,9 @@ CASE WHEN p.worktree IS NOT NULL AND p.worktree != '/' THEN s.project_id
 
 # Join + effective-key mapping live in a derived table so `id`/`worktree` are
 # unambiguous result columns (s.id and p.id would otherwise clash in GROUP BY).
-ROLLUP_SQL = f"""
+# `{time_filter}` ("" or a WHERE on s.time_created) is filled in per request for
+# the since/until window.
+ROLLUP_SQL = """
 SELECT gid AS id,
        MAX(worktree) AS worktree,
        COUNT(*) AS session_count,
@@ -57,11 +59,12 @@ FROM (
     SELECT s.project_id, s.id AS sid, s.parent_id, s.cost, s.tokens_input,
            s.tokens_output, s.tokens_reasoning, s.tokens_cache_read,
            s.tokens_cache_write,
-           {EFF_SQL} AS gid,
+           {eff_sql} AS gid,
            CASE WHEN p.worktree IS NOT NULL AND p.worktree != '/' THEN p.worktree
                 ELSE s.directory END AS worktree
     FROM session s
     LEFT JOIN project p ON p.id = s.project_id
+    {time_filter}
 ) AS eff
 """
 
@@ -72,13 +75,13 @@ SELECT id, parent_id, project_id, title, agent, model, cost,
 FROM session
 """
 
-PROJECT_SESSIONS_SQL = f"""
+PROJECT_SESSIONS_SQL = """
 SELECT s.id, s.parent_id, s.project_id, s.title, s.agent, s.model, s.cost,
        s.tokens_input, s.tokens_output, s.tokens_reasoning, s.tokens_cache_read,
        s.tokens_cache_write, s.time_created, s.time_updated
 FROM session s
 LEFT JOIN project p ON p.id = s.project_id
-WHERE {EFF_SQL} = ?
+WHERE {eff_sql} = ?{time_filter}
 ORDER BY s.cost DESC, s.id ASC
 """
 
@@ -99,6 +102,29 @@ WHERE json_extract(data, '$.role') = 'assistant'
 """
 
 
+def _time_fragment(col: str, since, until) -> tuple[str, tuple]:
+    """Half-open [since, until) filter on `col`. Fragment starts with ' AND '
+    so it appends after an existing WHERE; callers with no WHERE strip it.
+    Returns ("", ()) when neither bound is given."""
+    conds, params = [], []
+    if since is not None:
+        conds.append(f"{col} >= ?")
+        params.append(since)
+    if until is not None:
+        conds.append(f"{col} < ?")
+        params.append(until)
+    if not conds:
+        return "", ()
+    return " AND " + " AND ".join(conds), tuple(params)
+
+
+def _rollup(since=None, until=None) -> tuple[str, tuple]:
+    tf, tp = _time_fragment("s.time_created", since, until)
+    if tf:
+        tf = "WHERE " + tf[5:]
+    return ROLLUP_SQL.format(eff_sql=EFF_SQL, time_filter=tf), tp
+
+
 def normalize_model(mid) -> str | None:
     """Strip a provider prefix if present: deepseek/deepseek-v4-flash -> deepseek-v4-flash."""
     if not mid:
@@ -174,8 +200,9 @@ def updated_at(runner) -> int:
     return int(row["m"] or 0)
 
 
-def overview(runner) -> dict:
-    r = runner.query(ROLLUP_SQL)[0]
+def overview(runner, since=None, until=None) -> dict:
+    sql, tp = _rollup(since, until)
+    r = runner.query(sql, tp)[0]
     return {
         "projectCount": int(r["project_count"] or 0),
         "sessionCount": int(r["session_count"] or 0),
@@ -186,22 +213,29 @@ def overview(runner) -> dict:
     }
 
 
-def projects(runner) -> list[dict]:
+def projects(runner, since=None, until=None) -> list[dict]:
+    sql, tp = _rollup(since, until)
     rows = runner.query(
-        ROLLUP_SQL + " GROUP BY id, worktree"
-        " ORDER BY cost DESC, id ASC"
+        sql + " GROUP BY id, worktree"
+        " ORDER BY cost DESC, id ASC",
+        tp,
     )
     return [_project(r) for r in rows]
 
 
-def project_detail(runner, project_id) -> tuple[dict, list[dict]] | None:
+def project_detail(runner, project_id, since=None, until=None) -> tuple[dict, list[dict]] | None:
+    sql, tp = _rollup(since, until)
     rows = runner.query(
-        ROLLUP_SQL + " GROUP BY id, worktree HAVING id = ?",
-        (project_id,),
+        sql + " GROUP BY id, worktree HAVING id = ?",
+        tp + (project_id,),
     )
     if not rows:
         return None
-    sessions = runner.query(PROJECT_SESSIONS_SQL, (project_id,))
+    tf, tps = _time_fragment("s.time_created", since, until)
+    sessions = runner.query(
+        PROJECT_SESSIONS_SQL.format(eff_sql=EFF_SQL, time_filter=tf),
+        (project_id,) + tps,
+    )
     return _project(rows[0]), [_session(r) for r in sessions]
 
 
@@ -216,20 +250,22 @@ def _model_entry(d: dict) -> dict:
     }
 
 
-def session_detail(runner, session_id) -> tuple[dict, list[dict]] | None:
-    rows = runner.query(SESSIONS_SQL + " WHERE id = ?", (session_id,))
+def session_detail(runner, session_id, since=None, until=None) -> tuple[dict, list[dict]] | None:
+    tf, tp = _time_fragment("time_created", since, until)
+    rows = runner.query(SESSIONS_SQL + " WHERE id = ?" + tf, (session_id,) + tp)
     if not rows:
         return None
+    mf, mp = _time_fragment("message.time_created", since, until)
     msg_rows = runner.query_tsv(
-        MESSAGES_SQL + " AND session_id = ? GROUP BY model_id, provider, mode",
-        (session_id,),
+        MESSAGES_SQL + " AND session_id = ?" + mf + " GROUP BY model_id, provider, mode",
+        (session_id,) + mp,
     )
     models = [_model_entry(dict(zip(_MSG_KEYS, row))) for row in msg_rows]
     models.sort(key=lambda m: (-m["cost"], m["model"] or ""))
     return _session(rows[0]), models
 
 
-def models(runner) -> list[dict]:
+def models(runner, since=None, until=None) -> list[dict]:
     """Whole-host per-model rollup from message.data (same shape as the
     per-session model breakdown, but aggregated across all sessions).
 
@@ -238,7 +274,10 @@ def models(runner) -> list[dict]:
     deepseek/deepseek-v4-flash vs deepseek-v4-flash) don't create duplicate
     slices. On merge, the higher-cost row keeps its provider/mode label.
     """
-    msg_rows = runner.query_tsv(MESSAGES_SQL + " GROUP BY model_id, provider, mode")
+    mf, mp = _time_fragment("message.time_created", since, until)
+    msg_rows = runner.query_tsv(
+        MESSAGES_SQL + mf + " GROUP BY model_id, provider, mode", mp
+    )
     merged: dict[str, dict] = {}
     for row in msg_rows:
         e = _model_entry(dict(zip(_MSG_KEYS, row)))

opencode_dashboard_server-0.5.0/app.py

@@ -0,0 +1,354 @@
+"""FastAPI app implementing the API.md contract over the opencode aggregator.
+
+Aggregation runs against a large DB, so results are cached in memory and
+refreshed on a fixed poll interval instead of being recomputed per request.
+
+Run:  uv run uvicorn app:app --reload
+"""
+
+import asyncio
+import importlib.metadata
+import json
+import logging
+import os
+import socket
+import subprocess
+import threading
+import time
+from collections.abc import Callable
+from contextlib import asynccontextmanager
+from functools import lru_cache
+
+from fastapi import FastAPI, HTTPException, Query
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import StreamingResponse
+
+import aggregate
+from db import CliRunner
+
+logger = logging.getLogger("dashboard")
+
+# Comma-separated CORS allow-list; defaults to the loopback dev origins. Tight
+# by default so a random webpage can't exfiltrate local project/session data.
+def default_cors_origins() -> list[str]:
+    env = os.environ.get("DASHBOARD_CORS_ORIGINS", "").strip()
+    if env:
+        return [o.strip() for o in env.split(",") if o.strip()]
+    return [
+        "http://localhost:5173", "http://127.0.0.1:5173",
+        "http://localhost:4173", "http://127.0.0.1:4173",
+    ]
+
+
+@lru_cache(maxsize=8)
+def opencode_version(executable: str = "opencode") -> str:
+    try:
+        return subprocess.run(
+            [executable, "--version"], capture_output=True, text=True, check=True
+        ).stdout.strip()
+    except (OSError, subprocess.CalledProcessError):
+        return "unknown"  # e.g. CI without the opencode CLI; don't fail the request
+
+
+def dashboard_version() -> str:
+    try:
+        return importlib.metadata.version("opencode-dashboard-server")
+    except importlib.metadata.PackageNotFoundError:
+        return "unknown"  # e.g. pytest from a plain checkout; don't fail the request
+
+
+class Cache:
+    """In-memory result cache keyed by (kind, id, since, until) where kind is
+    the endpoint, id the project/session id (None for whole-dataset endpoints),
+    and since/until the time-range query params (None = unbounded) — so
+    `/overview?since=A` and `/overview?since=B` are distinct entries and never
+    collide with each other or with the all-time result.
+
+    Values fill lazily on first request. Whole-dataset kinds (overview,
+    projects, models) are refreshed by the background poll loop across every
+    observed range variant (bounded); per-id kinds (project, session) are
+    refreshed only when a request finds them older than ttl, so the heavy
+    session_detail SQL runs at most once per ttl per session and _values stays
+    bounded. A failed refresh keeps the previous value (stale-serve); a failed
+    first fill propagates to the caller (500 — nothing cached yet).
+    """
+
+    _WHOLE = frozenset({"overview", "projects", "models"})
+    _MAX_PER_KIND = 512  # per-id kinds: evict oldest beyond this cap
+    _MAX_RANGE_VARIANTS = 16  # whole kinds: bound distinct since/until combos
+
+    def __init__(self, ttl=None):
+        self._lock = threading.Lock()
+        self._loaders: dict[str, Callable] = {}
+        self._values: dict[tuple, tuple] = {}
+        self._ranges: dict[str, list[tuple]] = {}  # whole kind -> observed (since, until), oldest first
+        self._ttl = ttl  # per-id kinds refresh on request when older than this
+
+    def register(self, kind: str, loader):
+        self._loaders[kind] = loader
+
+    def get(self, kind: str, key=None, since=None, until=None):
+        full = (kind, key, since, until)
+        with self._lock:
+            entry = self._values.get(full)  # None = never cached
+        if entry is not None:
+            value, stored_at = entry
+            if kind in self._WHOLE or self._ttl is None \
+                    or time.monotonic() - stored_at < self._ttl:
+                return value
+            try:  # stale per-id entry: refresh on request, keep stale on failure
+                value = self._loaders[kind](key, since, until)
+            except Exception:
+                logger.exception("stale cache refresh failed for %s; serving stale", full)
+                return value
+            with self._lock:
+                self._values[full] = (value, time.monotonic())
+            return value
+        value = self._loaders[kind](key, since, until)
+        with self._lock:
+            self._values[full] = (value, time.monotonic())
+            self._evict_if_grown(kind, full)
+        return value
+
+    def refresh(self, full: tuple):
+        kind, key, since, until = full
+        value = self._loaders[kind](key, since, until)
+        with self._lock:
+            self._values[full] = (value, time.monotonic())
+            self._evict_if_grown(kind, full)
+
+    def _evict_if_grown(self, kind, full):
+        """Bound _values: whole kinds by distinct range-variant count, per-id
+        kinds by entry count. Drop the least-recently-stored entry."""
+        if kind in self._WHOLE:
+            ranges = self._ranges.setdefault(kind, [])
+            variant = full[2:]
+            if variant not in ranges:
+                ranges.append(variant)
+                if len(ranges) > self._MAX_RANGE_VARIANTS:
+                    self._values.pop((kind, None) + ranges.pop(0), None)
+            return
+        entries = [k for k in self._values if k[0] == kind]
+        if len(entries) > self._MAX_PER_KIND:
+            del self._values[min(entries, key=lambda k: self._values[k][1])]
+
+    def poll_keys(self):
+        """Keys the background loop refreshes: whole-dataset kinds across every
+        observed range variant, plus the all-time variant (always included, so
+        pre-warm and the stream's updatedAt signal never depend on a prior
+        request); per-id entries are handled lazily in get()."""
+        with self._lock:
+            keys = []
+            for kind in self._loaders:
+                if kind not in self._WHOLE:
+                    continue
+                variants = set(self._ranges.get(kind) or [])
+                variants.add((None, None))  # all-time variant always refreshed
+                keys += [(kind, None, since, until) for since, until in variants]
+            return keys
+
+    def overview(self):
+        """All-time overview (stream signal). updatedAt is a DB-wide max and
+        range-independent, so the all-time entry drives /stream correctly."""
+        with self._lock:
+            entry = self._values.get(("overview", None, None, None))
+            return entry[0] if entry else None
+
+
+class StreamHub:
+    """Fan-out for /stream subscribers. The poll loop broadcasts to every
+    connected SSE client; clients never query the DB themselves."""
+
+    def __init__(self):
+        self._lock = asyncio.Lock()
+        self._subs: set[asyncio.Queue] = set()
+
+    async def subscribe(self) -> asyncio.Queue:
+        q: asyncio.Queue = asyncio.Queue()
+        async with self._lock:
+            self._subs.add(q)
+        return q
+
+    async def unsubscribe(self, q: asyncio.Queue) -> None:
+        async with self._lock:
+            self._subs.discard(q)
+
+    async def broadcast(self, payload) -> None:
+        async with self._lock:
+            subs = list(self._subs)
+        for q in subs:
+            q.put_nowait(payload)
+
+
+def poll_event(overview, last_updated, ticks):
+    """Stream event for one cache-refresh tick. Emits `updated` only when the
+    overview's updatedAt advances; otherwise a heartbeat every 3rd tick (None
+    between). Returns (payload | None, new_last_updated)."""
+    if overview and overview.get("updatedAt") and overview["updatedAt"] != last_updated:
+        return {"type": "updated", "at": overview["updatedAt"], "scope": "overview"}, \
+            overview["updatedAt"]
+    if ticks % 3 == 0:
+        return {"type": "heartbeat"}, last_updated
+    return None, last_updated
+
+
+def create_app(runner=None, cors_origins=None, poll_seconds=None, opencode_bin=None) -> FastAPI:
+    bin = opencode_bin or os.environ.get("OPENCODE_BIN") or "opencode"
+    if runner is None:
+        runner = CliRunner(executable=bin)
+    origins = cors_origins if cors_origins is not None else default_cors_origins()
+    if poll_seconds is None:
+        try:
+            poll_seconds = float(os.environ.get("DASHBOARD_POLL_SECONDS", "5"))
+        except ValueError:
+            poll_seconds = 5.0
+
+    cache = Cache(ttl=poll_seconds)
+    hub = StreamHub()
+
+    cache.register("overview", lambda key, since, until: (
+        aggregate.overview(runner, since, until)
+        | {"host": socket.gethostname(), "opencodeVersion": opencode_version(bin),
+           "dashboardVersion": dashboard_version()}
+    ))
+    cache.register("projects", lambda key, since, until: aggregate.projects(runner, since, until))
+    cache.register("models", lambda key, since, until: aggregate.models(runner, since, until))
+
+    def load_project(key, since, until):
+        res = aggregate.project_detail(runner, key, since, until)
+        if res is None:
+            return None
+        proj, sessions = res
+        return {"project": proj, "sessions": sessions}
+
+    def load_session(key, since, until):
+        res = aggregate.session_detail(runner, key, since, until)
+        if res is None:
+            return None
+        sess, models = res
+        return {"session": sess, "models": models}
+
+    cache.register("project", load_project)
+    cache.register("session", load_session)
+
+    async def poll():
+        loop = asyncio.get_running_loop()
+        last_updated = None
+        ticks = 0
+        while True:
+            # Only whole-dataset kinds refresh on the clock, across every
+            # observed range variant; per-id entries are refreshed lazily in
+            # Cache.get, so session_detail's heavy SQL runs once per ttl per
+            # session and _values stays bounded.
+            for full in cache.poll_keys():
+                try:
+                    await loop.run_in_executor(None, cache.refresh, full)
+                except Exception:
+                    logger.exception("cache refresh failed for %s; serving stale", full)
+            ticks += 1
+            event, last_updated = poll_event(cache.overview(), last_updated, ticks)
+            if event is not None:
+                await hub.broadcast(event)
+            # True period is refresh-time + poll_seconds (refresh is synchronous
+            # on the executor above, so this sleep starts only after it).
+            await asyncio.sleep(poll_seconds)
+
+    @asynccontextmanager
+    async def lifespan(app):
+        loop = asyncio.get_running_loop()
+        # Pre-warm whole-dataset keys so /stream's first updated event (and the
+        # first request) don't depend on someone GETting /overview first.
+        for full in cache.poll_keys():
+            try:
+                await loop.run_in_executor(None, cache.refresh, full)
+            except Exception:
+                logger.exception("initial cache fill failed for %s; will retry on request", full)
+        task = asyncio.create_task(poll())
+        try:
+            yield
+        finally:
+            task.cancel()
+            try:
+                await task
+            except asyncio.CancelledError:
+                pass
+
+    app = FastAPI(title="opencode token dashboard", lifespan=lifespan)
+    app.state.cache = cache
+    # Loopback-only API; restrict origins so a random webpage can't exfiltrate
+    # local project/session data from the browser (the client runs from Vite).
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=origins,
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
+    def handle(fn):
+        try:
+            return fn()
+        except HTTPException:
+            raise
+        except Exception:
+            logger.exception("aggregation failed")
+            raise HTTPException(500, detail="aggregation failed")
+
+    @app.get("/health")
+    def health():
+        return {"status": "ok", "version": opencode_version(bin)}
+
+    @app.get("/overview")
+    def overview(since: int | None = Query(None), until: int | None = Query(None)):
+        return handle(lambda: cache.get("overview", since=since, until=until))
+
+    @app.get("/projects")
+    def projects(since: int | None = Query(None), until: int | None = Query(None)):
+        return handle(lambda: cache.get("projects", since=since, until=until))
+
+    @app.get("/models")
+    def models(since: int | None = Query(None), until: int | None = Query(None)):
+        return handle(lambda: cache.get("models", since=since, until=until))
+
+    @app.get("/projects/{project_id}")
+    def project(project_id: str, since: int | None = Query(None), until: int | None = Query(None)):
+        def run():
+            res = cache.get("project", project_id, since, until)
+            if res is None:
+                raise HTTPException(404, detail=f"project {project_id} not found")
+            return res
+
+        return handle(run)
+
+    @app.get("/sessions/{session_id}")
+    def session(session_id: str, since: int | None = Query(None), until: int | None = Query(None)):
+        def run():
+            res = cache.get("session", session_id, since, until)
+            if res is None:
+                raise HTTPException(404, detail=f"session {session_id} not found")
+            return res
+
+        return handle(run)
+
+    @app.get("/stream")
+    async def stream():
+        q = await hub.subscribe()
+        await q.put({"type": "heartbeat"})
+
+        async def gen():
+            try:
+                while True:
+                    payload = await q.get()
+                    data = json.dumps(payload)
+                    if payload["type"] == "updated":
+                        yield f"event: update\ndata: {data}\n\n"
+                    else:
+                        yield f"data: {data}\n\n"
+            finally:
+                await hub.unsubscribe(q)
+
+        return StreamingResponse(gen(), media_type="text/event-stream")
+
+    return app
+
+
+app = create_app()

{opencode_dashboard_server-0.4.0 → opencode_dashboard_server-0.5.0}/opencode_dashboard_server.egg-info/PKG-INFO

@@ -1,16 +1,19 @@
 Metadata-Version: 2.4
 Name: opencode-dashboard-server
-Version: 0.4.0
+Version: 0.5.0
 Summary: FastAPI aggregator over opencode's SQLite storage
+License-Expression: MIT
 Project-URL: Homepage, https://github.com/GCS-ZHN/opencode-dashboard
 Project-URL: Repository, https://github.com/GCS-ZHN/opencode-dashboard
 Project-URL: Issues, https://github.com/GCS-ZHN/opencode-dashboard/issues
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
+License-File: LICENSE.md
 Requires-Dist: fastapi<1,>=0.115
 Requires-Dist: uvicorn<1,>=0.30
 Requires-Dist: platformdirs<5,>=4
 Requires-Dist: PyYAML<7,>=6
+Dynamic: license-file
 
 # opencode-dashboard-server
 

{opencode_dashboard_server-0.4.0 → opencode_dashboard_server-0.5.0}/opencode_dashboard_server.egg-info/SOURCES.txt

@@ -1,3 +1,4 @@
+LICENSE.md
 README.md
 aggregate.py
 app.py

{opencode_dashboard_server-0.4.0 → opencode_dashboard_server-0.5.0}/pyproject.toml

@@ -4,9 +4,11 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "opencode-dashboard-server"
-version = "0.4.0"
+version = "0.5.0"
 description = "FastAPI aggregator over opencode's SQLite storage"
 readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE.md"]
 requires-python = ">=3.10"
 dependencies = [
     "fastapi>=0.115,<1",

{opencode_dashboard_server-0.4.0 → opencode_dashboard_server-0.5.0}/tests/test_aggregate.py

@@ -149,3 +149,60 @@ def test_models_hostwide_rollup(runner):
     assert kimi["messageCount"] == 1  # only m4; the m5 user message is excluded
     assert kimi["tokens"] == ZERO_TOKENS
     assert kimi["cost"] == 0.0
+
+
+def test_overview_time_filter(runner):
+    o = overview(runner, since=140000)
+    assert o["sessionCount"] == 4  # s4, s5, s6, s8
+    assert o["mainSessionCount"] == 4
+    assert o["projectCount"] == 3
+    assert o["cost"] == 4.6
+    assert overview(runner, since=150000)["sessionCount"] == 3
+    assert overview(runner, until=150000)["sessionCount"] == 5  # s1..s4 + s7
+
+
+def test_overview_window_is_half_open(runner):
+    # s3.time_created == 115000 must NOT match until=115000
+    o = overview(runner, until=115000)
+    assert o["sessionCount"] == 2  # s1, s7
+    assert o["cost"] == 2.1
+
+
+def test_projects_time_filter(runner):
+    ps = projects(runner, since=140000)
+    assert [p["id"] for p in ps] == ["proj-ccc", "proj-bbb", DIR_DASH]
+    bbb = ps[1]
+    assert bbb["sessionCount"] == 2  # s4, s5
+    assert bbb["cost"] == 0.9
+
+
+def test_project_detail_time_filter(runner):
+    proj, sessions = project_detail(runner, "proj-aaa", since=115000)
+    assert proj["cost"] == 0.7  # s2 + s3 (s1 outside the window)
+    # s3 stays a subagent: its parent s1 is only outside the window, not the DB
+    assert proj["mainSessionCount"] == 1
+    assert [s["id"] for s in sessions] == ["s2", "s3"]  # cost desc
+    assert project_detail(runner, "proj-aaa", since=130000) is None
+
+
+def test_session_detail_time_filter(runner):
+    sess, ms = session_detail(runner, "s4", until=143500)
+    assert sess["id"] == "s4"  # s4.time_created (140000) < until
+    # m6 (144000) excluded; m1+m2 merge into the deepseek/build entry
+    assert [m["model"] for m in ms] == ["deepseek-v4-flash", "claude-sonnet-4.5"]
+    assert ms[0]["messageCount"] == 2
+    assert ms[0]["cost"] == 0.6
+    assert ms[1]["messageCount"] == 1
+    assert ms[1]["cost"] == 0.3
+    assert session_detail(runner, "s4", since=150000) is None  # session itself out of window
+
+
+def test_models_message_time_filter(runner):
+    ms = models(runner, since=143000)
+    assert [m["model"] for m in ms] == ["claude-sonnet-4.5", "deepseek-v4-flash", "kimi-k3"]
+    assert ms[0]["cost"] == 0.3
+    assert ms[1]["provider"] == "openrouter"  # m6 only; m1+m2 are before since
+    assert ms[1]["messageCount"] == 1
+    assert ms[1]["cost"] == 0.1
+    assert ms[2]["messageCount"] == 1  # m4 only
+    assert models(runner, since=152000) == []  # no token-bearing messages left

opencode_dashboard_server-0.5.0/tests/test_app.py

@@ -0,0 +1,258 @@
+"""HTTP-level smoke tests + the SQL-inlining boundary (CliRunner's only injection
+surface). Driven via create_app(SqliteRunner) over the in-memory fixture, so no
+`opencode db` CLI spawn happens."""
+
+import asyncio
+import sqlite3
+
+import pytest
+from fastapi.testclient import TestClient
+
+import app as appmod
+from db import SqliteRunner, _inline
+from tests.conftest import SCHEMA, seed
+
+
+def make_client() -> TestClient:
+    conn = sqlite3.connect(":memory:", check_same_thread=False)
+    conn.executescript(SCHEMA)
+    seed(conn)
+    return TestClient(appmod.create_app(SqliteRunner(conn))), conn
+
+
+class CountingRunner:
+    """Wraps a SqliteRunner and counts query calls (proves cache hits)."""
+
+    def __init__(self, inner):
+        self._inner = inner
+        self.queries = 0
+
+    def query(self, sql, params=()):
+        self.queries += 1
+        return self._inner.query(sql, params)
+
+    def query_tsv(self, sql, params=()):
+        self.queries += 1
+        return self._inner.query_tsv(sql, params)
+
+
+def test_inline_quotes_and_escapes():
+    sql = _inline("WHERE id = ? AND cost > ?", ("a'b\";\nDROP", 5))
+    assert sql == "WHERE id = 'a''b\";\nDROP' AND cost > 5"
+    assert 'DROP' in sql  # payload stays inside one quoted literal
+
+
+def test_unknown_project_404():
+    c, _ = make_client()
+    r = c.get("/projects/nope")
+    assert r.status_code == 404
+    assert r.json() == {"detail": "project nope not found"}
+
+
+def test_overview_keys():
+    c, _ = make_client()
+    r = c.get("/overview")
+    assert r.status_code == 200
+    assert {"host", "opencodeVersion", "dashboardVersion", "projectCount", "sessionCount",
+            "tokens", "cost", "updatedAt"} <= set(r.json())
+
+
+def test_models_keys():
+    c, _ = make_client()
+    r = c.get("/models")
+    assert r.status_code == 200
+    rows = r.json()
+    assert rows  # fixture seeds assistant token-bearing messages
+    assert {"model", "provider", "mode", "messageCount", "tokens", "cost"} <= set(rows[0])
+    assert rows == sorted(rows, key=lambda m: (-m["cost"], m["model"] or ""))
+
+
+def test_foreign_origin_not_allowed_by_cors():
+    c, _ = make_client()
+    r = c.options("/projects", headers={
+        "Origin": "https://evil.example",
+        "Access-Control-Request-Method": "GET",
+    })
+    assert "access-control-allow-origin" not in r.headers
+
+
+def test_cors_origins_injection():
+    conn = sqlite3.connect(":memory:", check_same_thread=False)
+    conn.executescript(SCHEMA)
+    seed(conn)
+    app = appmod.create_app(SqliteRunner(conn), cors_origins=["http://a.com"])
+    c = TestClient(app)
+    ok = c.options("/projects", headers={"Origin": "http://a.com", "Access-Control-Request-Method": "GET"})
+    assert ok.headers.get("access-control-allow-origin") == "http://a.com"
+    nope = c.options("/projects", headers={"Origin": "http://a.co", "Access-Control-Request-Method": "GET"})
+    assert "access-control-allow-origin" not in nope.headers
+
+
+def test_since_until_pass_through():
+    c, _ = make_client()
+    r = c.get("/projects", params={"since": 140000})
+    assert r.status_code == 200
+    assert [p["id"] for p in r.json()] == ["proj-ccc", "proj-bbb", "dir:2f55736572732f746573742f70726f6a656374732f6f70656e636f64652d64617368626f617264"]
+    r = c.get("/overview", params={"since": 140000, "until": 150000})
+    assert r.status_code == 200
+    assert r.json()["sessionCount"] == 1  # only s4
+    r = c.get("/sessions/s4", params={"until": 143500})
+    assert r.status_code == 200
+    assert [m["model"] for m in r.json()["models"]] == ["deepseek-v4-flash", "claude-sonnet-4.5"]
+    # session outside the window 404s
+    r = c.get("/sessions/s4", params={"since": 150000})
+    assert r.status_code == 404
+
+
+def test_non_integer_since_is_422():
+    c, _ = make_client()
+    assert c.get("/overview", params={"since": "abc"}).status_code == 422
+
+
+def make_cached_client():
+    """App over a counting runner so cache behavior is observable via query count.
+
+    Note: TestClient is used WITHOUT a context manager, so lifespan (background
+    poll + pre-warm) never runs — cache state is driven purely by the requests
+    below. The one lifespan-driven test is test_lifespan_prewarms_whole_dataset.
+    """
+    conn = sqlite3.connect(":memory:", check_same_thread=False)
+    conn.executescript(SCHEMA)
+    seed(conn)
+    counter = CountingRunner(SqliteRunner(conn))
+    return TestClient(appmod.create_app(counter)), conn, counter
+
+
+def test_repeated_overview_served_from_cache():
+    c, _, counter = make_cached_client()
+    first = c.get("/overview")
+    assert first.status_code == 200
+    after_first = counter.queries
+    assert after_first > 0
+    second = c.get("/overview")
+    assert second.json() == first.json()
+    assert counter.queries == after_first  # cache hit: no re-aggregation
+
+
+def test_refresh_recomputes_overview_after_db_change():
+    c, conn, counter = make_cached_client()
+    before = c.get("/overview").json()
+    assert before["sessionCount"] == 8
+    c.get("/overview")  # warm the cache
+    c.get("/overview")
+    counter.queries = 0
+    conn.execute(
+        "INSERT INTO session (id, project_id, slug, directory, title, version,"
+        " time_created, time_updated) VALUES ('s9','proj-aaa','s9','/x','new',"
+        " 'local', 200000, 200000)"
+    )
+    appmod.Cache.refresh(c.app.state.cache, ("overview", None, None, None))
+    counter.queries = 0
+    after = c.get("/overview").json()
+    assert after["sessionCount"] == 9
+    assert after["updatedAt"] == 200000
+    assert counter.queries == 0  # served from the refreshed cache, no request-time query
+
+
+def test_failed_refresh_serves_stale_value():
+    c, _, counter = make_cached_client()
+    before = c.get("/overview").json()
+    c.get("/overview")
+    orig_query = counter._inner.query
+    def boom(sql, params=()):
+        raise RuntimeError("db down")
+    counter._inner.query = boom
+    with pytest.raises(RuntimeError):
+        appmod.Cache.refresh(c.app.state.cache, ("overview", None, None, None))  # refresh fails...
+    counter._inner.query = orig_query
+    after = c.get("/overview").json()
+    assert after == before  # ...but the stale value is still served
+
+
+def test_unknown_project_404_cached():
+    c, _, counter = make_cached_client()
+    assert c.get("/projects/nope").status_code == 404
+    after_first = counter.queries
+    assert after_first > 0
+    assert c.get("/projects/nope").status_code == 404
+    assert counter.queries == after_first  # 404s are cached too, no re-scan
+
+
+def test_first_fill_failure_returns_500():
+    c, _, counter = make_cached_client()
+    def boom(sql, params=()):
+        raise RuntimeError("db down")
+    counter._inner.query = boom
+    r = c.get("/overview")  # nothing cached yet, so the fill failure must surface
+    assert r.status_code == 500
+    assert r.json() == {"detail": "aggregation failed"}
+
+
+def test_lifespan_prewarms_whole_dataset_kinds():
+    """with TestClient(...) runs lifespan: whole-dataset keys are pre-warmed (no
+    request needed) and poll_seconds is huge so the background loop just idles."""
+    conn = sqlite3.connect(":memory:", check_same_thread=False)
+    conn.executescript(SCHEMA)
+    seed(conn)
+    counter = CountingRunner(SqliteRunner(conn))
+    app = appmod.create_app(counter, poll_seconds=3600)
+    with TestClient(app) as c:
+        assert counter.queries > 0  # pre-warm queried the DB with no request
+        assert c.app.state.cache.overview()["sessionCount"] == 8
+        assert {("projects", None, None, None), ("models", None, None, None)} <= set(c.app.state.cache._values)
+        first = c.get("/overview")
+        assert first.status_code == 200
+        assert first.json()["sessionCount"] == 8
+
+
+def test_poll_event_emits_updated_on_change_only():
+    payload, last = appmod.poll_event({"updatedAt": 100}, None, 1)
+    assert payload == {"type": "updated", "at": 100, "scope": "overview"}
+    assert last == 100
+    # no change, not a heartbeat tick -> nothing
+    assert appmod.poll_event({"updatedAt": 100}, 100, 2) == (None, 100)
+    # no change on a heartbeat tick (every 3rd) -> heartbeat
+    assert appmod.poll_event({"updatedAt": 100}, 100, 3) == ({"type": "heartbeat"}, 100)
+    # uncached overview -> nothing
+    assert appmod.poll_event(None, None, 3) == ({"type": "heartbeat"}, None)
+
+
+def test_stream_hub_fans_out_to_subscribers():
+    async def scenario():
+        hub = appmod.StreamHub()
+        q1, q2 = await hub.subscribe(), await hub.subscribe()
+        await hub.broadcast({"type": "updated", "at": 1, "scope": "overview"})
+        return await q1.get(), await q2.get()
+
+    e1, e2 = asyncio.run(scenario())
+    assert e1 == e2 == {"type": "updated", "at": 1, "scope": "overview"}
+
+
+
+def test_cache_keys_are_range_specific():
+    """The cache must key by (kind, id, since, until): two different ranges (and
+    the all-time view) on the same endpoint must not collide."""
+    c, _, counter = make_cached_client()
+    all_time = c.get("/overview").json()
+    window = c.get("/overview", params={"since": 140000, "until": 150000}).json()
+    assert all_time["sessionCount"] == 8
+    assert window["sessionCount"] == 1  # only s4
+    assert c.get("/overview").json() == all_time  # all-time entry untouched
+    assert c.get("/overview", params={"since": 140000, "until": 150000}).json() == window
+    after = counter.queries
+    # all variants are cached now — no re-aggregation on repeat hits
+    c.get("/overview")
+    c.get("/overview", params={"since": 140000, "until": 150000})
+    assert counter.queries == after
+    # distinct keys in the cache
+    keys = {k for k in c.app.state.cache._values if k[0] == "overview"}
+    assert ("overview", None, None, None) in keys
+    assert ("overview", None, 140000, 150000) in keys
+
+
+def test_poll_keys_cover_observed_range_variants():
+    c, _, _ = make_cached_client()
+    c.get("/overview", params={"since": 140000})
+    keys = c.app.state.cache.poll_keys()
+    assert ("overview", None, 140000, None) in keys  # observed variant refreshed
+    assert ("overview", None, None, None) in keys  # all-time always refreshed

opencode_dashboard_server-0.4.0/app.py

@@ -1,165 +0,0 @@
-"""FastAPI app implementing the API.md contract over the opencode aggregator.
-
-Run:  uv run uvicorn app:app --reload
-"""
-
-import asyncio
-import json
-import logging
-import os
-import socket
-import subprocess
-from functools import lru_cache
-
-from fastapi import FastAPI, HTTPException
-from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import StreamingResponse
-
-import aggregate
-from db import CliRunner
-
-logger = logging.getLogger("dashboard")
-
-# Comma-separated CORS allow-list; defaults to the loopback dev origins. Tight
-# by default so a random webpage can't exfiltrate local project/session data.
-def default_cors_origins() -> list[str]:
-    env = os.environ.get("DASHBOARD_CORS_ORIGINS", "").strip()
-    if env:
-        return [o.strip() for o in env.split(",") if o.strip()]
-    return [
-        "http://localhost:5173", "http://127.0.0.1:5173",
-        "http://localhost:4173", "http://127.0.0.1:4173",
-    ]
-
-
-@lru_cache(maxsize=8)
-def opencode_version(executable: str = "opencode") -> str:
-    try:
-        return subprocess.run(
-            [executable, "--version"], capture_output=True, text=True, check=True
-        ).stdout.strip()
-    except (OSError, subprocess.CalledProcessError):
-        return "unknown"  # e.g. CI without the opencode CLI; don't fail the request
-
-
-def create_app(runner=None, cors_origins=None, poll_seconds=None, opencode_bin=None) -> FastAPI:
-    bin = opencode_bin or os.environ.get("OPENCODE_BIN") or "opencode"
-    if runner is None:
-        runner = CliRunner(executable=bin)
-    origins = cors_origins if cors_origins is not None else default_cors_origins()
-    if poll_seconds is None:
-        try:
-            poll_seconds = float(os.environ.get("DASHBOARD_POLL_SECONDS", "5"))
-        except ValueError:
-            poll_seconds = 5.0
-    app = FastAPI(title="opencode token dashboard")
-    # Loopback-only API; restrict origins so a random webpage can't exfiltrate
-    # local project/session data from the browser (the client runs from Vite).
-    app.add_middleware(
-        CORSMiddleware,
-        allow_origins=origins,
-        allow_methods=["*"],
-        allow_headers=["*"],
-    )
-
-    def handle(fn):
-        try:
-            return fn()
-        except HTTPException:
-            raise
-        except Exception:
-            logger.exception("aggregation failed")
-            raise HTTPException(500, detail="aggregation failed")
-
-    @app.get("/health")
-    def health():
-        return {"status": "ok", "version": opencode_version(bin)}
-
-    @app.get("/overview")
-    def overview():
-        def run():
-            data = aggregate.overview(runner)
-            data["host"] = socket.gethostname()
-            data["opencodeVersion"] = opencode_version(bin)
-            return data
-
-        return handle(run)
-
-    @app.get("/projects")
-    def projects():
-        return handle(lambda: aggregate.projects(runner))
-
-    @app.get("/models")
-    def models():
-        return handle(lambda: aggregate.models(runner))
-
-    @app.get("/projects/{project_id}")
-    def project(project_id: str):
-        def run():
-            res = aggregate.project_detail(runner, project_id)
-            if res is None:
-                raise HTTPException(404, detail=f"project {project_id} not found")
-            proj, sessions = res
-            return {"project": proj, "sessions": sessions}
-
-        return handle(run)
-
-    @app.get("/sessions/{session_id}")
-    def session(session_id: str):
-        def run():
-            res = aggregate.session_detail(runner, session_id)
-            if res is None:
-                raise HTTPException(404, detail=f"session {session_id} not found")
-            sess, models = res
-            return {"session": sess, "models": models}
-
-        return handle(run)
-
-    @app.get("/stream")
-    async def stream():
-        q: asyncio.Queue = asyncio.Queue()
-        stop = asyncio.Event()
-
-        async def poll():
-            loop = asyncio.get_running_loop()
-            last = None
-            ticks = 0
-            while not stop.is_set():
-                try:
-                    ts = await loop.run_in_executor(None, aggregate.updated_at, runner)
-                    if ts and ts != last:
-                        last = ts
-                        await q.put({"type": "updated", "at": ts, "scope": "overview"})
-                    else:
-                        ticks += 1
-                        if ticks % 3 == 0:  # heartbeat every ~15s (poll = 5s)
-                            await q.put({"type": "heartbeat"})
-                except Exception:
-                    logger.exception("stream poll failed")
-                try:
-                    await asyncio.wait_for(stop.wait(), poll_seconds)
-                except asyncio.TimeoutError:
-                    pass
-
-        task = asyncio.create_task(poll())
-        await q.put({"type": "heartbeat"})
-
-        async def gen():
-            try:
-                while True:
-                    payload = await q.get()
-                    data = json.dumps(payload)
-                    if payload["type"] == "updated":
-                        yield f"event: update\ndata: {data}\n\n"
-                    else:
-                        yield f"data: {data}\n\n"
-            finally:
-                stop.set()
-                task.cancel()
-
-        return StreamingResponse(gen(), media_type="text/event-stream")
-
-    return app
-
-
-app = create_app()

opencode_dashboard_server-0.4.0/tests/test_app.py

@@ -1,70 +0,0 @@
-"""HTTP-level smoke tests + the SQL-inlining boundary (CliRunner's only injection
-surface). Driven via create_app(SqliteRunner) over the in-memory fixture, so no
-`opencode db` CLI spawn happens."""
-
-import sqlite3
-
-from fastapi.testclient import TestClient
-
-import app as appmod
-from db import SqliteRunner, _inline
-from tests.conftest import SCHEMA, seed
-
-
-def make_client() -> TestClient:
-    conn = sqlite3.connect(":memory:", check_same_thread=False)
-    conn.executescript(SCHEMA)
-    seed(conn)
-    return TestClient(appmod.create_app(SqliteRunner(conn))), conn
-
-
-def test_inline_quotes_and_escapes():
-    sql = _inline("WHERE id = ? AND cost > ?", ("a'b\";\nDROP", 5))
-    assert sql == "WHERE id = 'a''b\";\nDROP' AND cost > 5"
-    assert 'DROP' in sql  # payload stays inside one quoted literal
-
-
-def test_unknown_project_404():
-    c, _ = make_client()
-    r = c.get("/projects/nope")
-    assert r.status_code == 404
-    assert r.json() == {"detail": "project nope not found"}
-
-
-def test_overview_keys():
-    c, _ = make_client()
-    r = c.get("/overview")
-    assert r.status_code == 200
-    assert {"host", "opencodeVersion", "projectCount", "sessionCount",
-            "tokens", "cost", "updatedAt"} <= set(r.json())
-
-
-def test_models_keys():
-    c, _ = make_client()
-    r = c.get("/models")
-    assert r.status_code == 200
-    rows = r.json()
-    assert rows  # fixture seeds assistant token-bearing messages
-    assert {"model", "provider", "mode", "messageCount", "tokens", "cost"} <= set(rows[0])
-    assert rows == sorted(rows, key=lambda m: (-m["cost"], m["model"] or ""))
-
-
-def test_foreign_origin_not_allowed_by_cors():
-    c, _ = make_client()
-    r = c.options("/projects", headers={
-        "Origin": "https://evil.example",
-        "Access-Control-Request-Method": "GET",
-    })
-    assert "access-control-allow-origin" not in r.headers
-
-
-def test_cors_origins_injection():
-    conn = sqlite3.connect(":memory:", check_same_thread=False)
-    conn.executescript(SCHEMA)
-    seed(conn)
-    app = appmod.create_app(SqliteRunner(conn), cors_origins=["http://a.com"])
-    c = TestClient(app)
-    ok = c.options("/projects", headers={"Origin": "http://a.com", "Access-Control-Request-Method": "GET"})
-    assert ok.headers.get("access-control-allow-origin") == "http://a.com"
-    nope = c.options("/projects", headers={"Origin": "http://a.co", "Access-Control-Request-Method": "GET"})
-    assert "access-control-allow-origin" not in nope.headers