Restore archived tasks, fix dashboard scroll-reset, bind ornith, add Playwright smoke test
- **Restore 82 completed tasks** from tasks/complete/ back to tasks/ top level (all <7 days old per the cleanup policy; premature bulk archive was fixed). - **Dashboard: fix scroll-reset on auto-refresh** — renderBoard rebuilds the board via innerHTML every 2s, destroying each column-body's scrollTop. Now snapshots column-body scrollTop + board.scrollLeft + view.scrollTop before rebuild and restores after (matched by PHASE_GROUPS index). - **Dashboard UI additions** (pre-existing unstaged work): approval section cards, transition buttons, inline artifact editor (textarea for writing missing SPEC/VERDICT/etc from the detail modal). - **Bind ornith as Implement model** — config.md: Model explicit to omlx/Ornith-1.0-35B-4bit-mlx, context window 32768. Interactive autopilot already used ornith via opencode default; now explicit. - **Fix cleanup stub** — automaton-cleanup.sh had a stale --project arg pointing at a pytest temp dir (test isolation leak). Rewired to point at ~/.automaton. - **Fix plist-isolation test** — test asserted host plist doesn't exist, but a real install creates it. Now snapshots mtime before run, asserts unchanged after (only a write during the test counts as bleed). - **New Playwright smoke test** (tests/test_dashboard_ui.py) — 2 tests: board renders tasks, column scroll survives auto-refresh tick. Verified the test fails without the scroll fix (scrollTop resets to 0). Skipped via importorskip when playwright is absent (main CI stays green). - **Clarify SI loop scope in README** — new-project onboarding section documents the framework-scoped self-improvement loop and options (leave/pause/create project loop). - **CHANGELOG** documents all changes including the known model-divergence gap (mde tasks marked complete but per-role model binding was never implemented).
This commit is contained in:
Lap Tran
@@ -0,0 +1 @@
|
||||
complete
|
||||
@@ -0,0 +1,25 @@
|
||||
# Implementation: Wire DashboardConfig + Add Caching + Add Size Limits
|
||||
|
||||
## Summary
|
||||
- Added `GET /api/config` endpoint returning `config.to_dict()`
|
||||
- Added `PUT /api/config` endpoint accepting JSON body, validating via `DashboardConfig.validate()`, and persisting to `dashboard-config.json`
|
||||
- Added server-side task cache with 1-second TTL (`_get_cached_tasks`, `_invalidate_task_cache`)
|
||||
- `_serve_tasks` and `_serve_task` now use cached task list instead of calling `discover_tasks()` on every request
|
||||
- `_serve_review_summary` uses cached task list instead of iterating filesystem
|
||||
- Writing a review (`POST /api/task/{name}/review`) invalidates cache
|
||||
- R3 (content-length bounds) already implemented in harden-dashboard-security task
|
||||
- Dashboard.js now fetches `/api/config` on init and applies `theme`, `default_view`, `column_width`, `show_timelines`, `auto_refresh_interval`
|
||||
- Removed hardcoded `setInterval(refreshData, 2000)` — refresh interval is now config-driven
|
||||
- CORS headers updated to include `PUT` method
|
||||
|
||||
## Changes
|
||||
- `automaton/dashboard/ui/app.py`: Added `_task_cache`, `_get_cached_tasks`, `_invalidate_task_cache`, `_serve_config`, `_handle_config_update`, `do_PUT`; wired `DashboardHandler.config` class attribute; `_serve_tasks`, `_serve_task`, `_serve_review_summary` use cache; cache invalidation in `_handle_review`; CORS updated with PUT
|
||||
- `automaton/dashboard/html/dashboard.js`: Added `fetchConfig`, `applyConfig`; updated `startAutoRefresh` to accept interval; `DOMContentLoaded` now async and fetches config before starting refresh
|
||||
- `tests/test_app.py`: Added `TestTaskCache` (3 tests) and `TestConfigEndpoint` (4 tests)
|
||||
|
||||
## Test Results
|
||||
126 passed in 0.09s
|
||||
Dashboard starts (port conflict on 8080 is environmental, not a bug)
|
||||
|
||||
## Blockers
|
||||
None
|
||||
@@ -0,0 +1,4 @@
|
||||
# Review
|
||||
- **Status**: approved
|
||||
- **Timestamp**: 2026-06-14T20:17:49.656844
|
||||
- **Comment**:
|
||||
@@ -0,0 +1,68 @@
|
||||
# Wire DashboardConfig + Add Caching + Add Size Limits
|
||||
|
||||
## Goal
|
||||
|
||||
Activate the dead `DashboardConfig` module, add basic server-side caching to eliminate redundant disk I/O on every API request, and add input size limits to the review POST endpoint.
|
||||
|
||||
## Requirements
|
||||
|
||||
### R1. Wire DashboardConfig into the frontend
|
||||
|
||||
`dashboard/config.py` defines 5 settings but none are consumed by the server or client. `self.config` is loaded at `ui/app.py:323` and immediately abandoned.
|
||||
|
||||
**Fix**:
|
||||
- Add `GET /api/config` endpoint returning `config.to_dict()`
|
||||
- Add `PUT /api/config` endpoint accepting `body: dict` and calling `config.save()`
|
||||
- On dashboard init (`dashboard.js:466`), fetch `/api/config` and apply:
|
||||
- `auto_refresh_interval` → set polling interval (default 2s)
|
||||
- `default_view` → switch to board/stats/timeline on load
|
||||
- `theme` → set CSS `data-theme` attribute
|
||||
- `show_timelines` → show/hide timeline elements
|
||||
- `column_width` → set CSS `--col-min-width` variable
|
||||
- Remove hardcoded `setInterval(refreshData, 2000)` on line 462 and use config value
|
||||
|
||||
### R2. Add server-side caching for task scans
|
||||
|
||||
Currently every `/api/tasks`, `/api/task/{name}`, and `/api/review-summary` call does a full `discover_tasks()` — reading all artifact files from disk. At 2s polling, this is thousands of file reads per minute for ~84KB of data.
|
||||
|
||||
**Fix**:
|
||||
- Add a module-level cache with TTL (e.g., 1 second or triggered by review writes)
|
||||
- `/api/tasks` returns cached data within TTL window
|
||||
- `/api/task/{name}` looks up task by name from cached list instead of re-scanning
|
||||
- Writing a review (`/api/task/{name}/review` POST) invalidates the cache
|
||||
- Cache stores the list of `Task` objects, not the serialized JSON
|
||||
|
||||
### R3. Add input size limits to review POST
|
||||
|
||||
`ui/app.py:250-263` reads `content_length` from the header and reads the full body with no bounds check. A malicious client can:
|
||||
- Send `Content-Length: 999999999` and never send the body → blocks single-threaded server (DoS)
|
||||
- Send a 10MB comment → writes 10MB to REVIEW.md (disk abuse)
|
||||
|
||||
**Fix**:
|
||||
- Add `MAX_POST_BODY = 65536` (64KB) constant
|
||||
- If `content_length > MAX_POST_BODY`, return 413 Payload Too Large
|
||||
- If `content_length <= 0`, return 400 Bad Request
|
||||
- Cap `comment` to 4096 characters before writing to disk
|
||||
|
||||
### R4. Add `/api/task/{name}` to use cache
|
||||
|
||||
`_serve_task()` at `ui/app.py:170-195` calls `discover_tasks()` to find one task. Use the cache from R2 for O(1) lookup.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] `GET /api/config` returns current config as JSON
|
||||
- [ ] `PUT /api/config` with `{"theme": "dark"}` persists to `dashboard-config.json`
|
||||
- [ ] Dashboard JS reads config on init and applies theme, default_view, auto_refresh_interval
|
||||
- [ ] Changing config via dashboard-config.json and restarting dashboard applies the settings
|
||||
- [ ] `/api/tasks` within TTL returns cached data (no disk reads on second poll)
|
||||
- [ ] Writing a review via POST invalidates cache; next `/api/tasks` re-reads from disk
|
||||
- [ ] POST with `Content-Length: 1000000` returns 413
|
||||
- [ ] POST with comment > 4096 chars truncates to 4096 before writing
|
||||
- [ ] `test_config.py` tests still pass
|
||||
- [ ] `test_app.py` tests still pass
|
||||
|
||||
## Non-Goals
|
||||
|
||||
- Not implementing persistent caching (disk/memcached) — in-memory TTL is sufficient
|
||||
- Not adding authentication to config endpoints (config changes require local access by design)
|
||||
- Not optimizing `discover_tasks()` itself — the cache removes the hot path
|
||||
@@ -0,0 +1,21 @@
|
||||
# Verdict: wire-dashboard-config
|
||||
|
||||
## Status: PASS
|
||||
**Completion Date**: 2026-06-14
|
||||
|
||||
## Summary
|
||||
Activated dead DashboardConfig module with GET/PUT endpoints, added server-side task cache with 1s TTL to eliminate redundant disk I/O on every polling request, wired config values (theme, default_view, auto_refresh_interval, column_width, show_timelines) into dashboard JS on init. R3 (content-length bounds) was already done in harden-dashboard-security.
|
||||
|
||||
## Findings
|
||||
- All 126 tests pass (7 new: 3 cache, 4 config endpoint)
|
||||
- GET /api/config returns DashboardConfig as JSON
|
||||
- PUT /api/config validates, persists, and updates in-memory config
|
||||
- Task cache returns cached data within TTL, re-scans on TTL expiry
|
||||
- Review POSTinvalidates cache so next poll picks up review changes
|
||||
- Dashboard JS applies config on DOMContentLoaded before first refresh
|
||||
|
||||
## Tasks for Review / Tie-Breaks
|
||||
- None
|
||||
|
||||
## Score
|
||||
+10
|
||||
Reference in New Issue
Block a user