Bring `src/mitm/server.cjs` into compliance with the AgentBridge MITM
contract (master plan §3.5 / §12 acceptance #16). Prior to this commit
the bypass/passthrough logic existed in TS (`src/mitm/passthrough.ts`,
`src/mitm/targets/index.ts::routeConnection`, `src/lib/db/agentBridgeBypass.ts`)
but was completely disconnected from the running CJS proxy.
Changes:
- Add `server.on("connect", ...)` so HTTPS proxy clients can still tunnel
to non-AgentBridge hosts without losing internet. Per host the handler
decides:
- bypass (default regex or user glob) → raw TCP pipe, NO TLS decrypt,
NO content logging (privacy: bypass = "never see content")
- target (in TARGET_HOSTS) → write 200 Connection
Established and emit `connection` so the existing
`https.createServer` decrypts and routes via the normal flow
- passthrough (anything else) → raw TCP pipe
- Introduce `src/mitm/_internal/bypass.cjs` shim that mirrors
`DEFAULT_BYPASS_PATTERNS` and `routeConnection` from the TS source.
Defaults stay hardcoded (banks, gov, okta, auth0); user patterns load
from `<DATA_DIR>/mitm/bypass.json` (written by manager — separate commit).
- Add a CJS port of `sanitizeErrorMessage` and wire it into the intercept
error path so HTTP/SSE error bodies never expose raw `err.message`.
Closes a pre-existing Hard Rule #12 violation in the file.
Defaults match `src/mitm/passthrough.ts::DEFAULT_BYPASS_PATTERNS` and
`shouldBypass` precedence is identical to `routeConnection`. Antigravity
non-regression preserved — known hosts still trigger TLS termination via
the existing request handler.
Prop was declared but destructured as _onSlugChange (never consumed).
TranslatorPageClient relies on onOpenChange callbacks on each child
accordion instead. Cleaning the interface.
Both accordions initialized open/hasOpened from forceOpen but never
reacted to forceOpen changes after mount. RawJsonPanel and PipelineView
already had this useEffect. Aligns the pattern so back/forward navigation
and inter-accordion switches work consistently.
Uses useRef to track false→true transitions only, so a manual close by the
user is not immediately overridden while forceOpen remains true.
Collapsible does not expose onOpenChange, so clicking the accordion header
opens it but leaves {hasOpened && ...} false, rendering an empty container.
The ref callback (same pattern as RawJsonPanel) detects the first DOM
mount inside the Collapsible and sets hasOpened + notifies parent.
Adds regression test covering manual click flow (existing tests only
exercised defaultOpen=true). Also updates the pre-existing lazy-render test
whose assertion was incompatible with the new ref callback (Collapsible stub
always renders children, so the ref fires immediately — asserting 0 items
was only valid without the ref; the meaningful part of the test is preserved).
- FilesListTab: add (input)/(output)/(error) role label next to batch id in Used by column + tooltip (G-AUD1, plan §4 wireframe `b1 (input)`)
- BatchListTab: add -50% inline badge on Cost column per wireframe §3 `$6.20 (-50%)` (G-AUD2) + (partial) suffix on progress when expired_with_failures (G-AUD3)
- ExpirationBadge: document <1h/<6h/<24h tier semantics + >24h graceful fallback (G-AUD4)
- 4 new i18n keys in en + pt-BR (filesListUsedByRoleInput/Output/Error, batchListProgressPartial); 40 locales auto-filled via fill-missing-from-en.mjs
- Update list-regression test #13 to assert new used-by format (truncated id + role label + tooltip carries full id+role)
AgentCard.handleRiskAccept was calling markRiskAccepted() before opening the
RiskNoticeModal, which itself writes the same key via dontShowAgainKey on accept.
Remove the redundant markRiskAccepted call and delete the now-unused helper so
RiskNoticeModal (D16) is the sole canonical persistence owner. Add a spy-based
test asserting the key is written exactly once per accept.
Move all recharts rendering into StatsCharts.tsx and replace the orphaned
_rechartsPreload no-op with a proper next/dynamic() call (ssr: false), achieving
real bundle split so recharts is not included in the initial page chunk.
Two gaps found in second-pass code review of Group B:
1. B26 violation: DELETE /api/quota/plans/[connectionId] did not emit
logAuditEvent. Per master plan B26, every plan mutation must audit.
Now emits quota.plan.updated with metadata.reverted=true to mark the
revert-to-auto/catalog semantic. Test integration extended with
assertion that audit event is present after DELETE.
2. pt-BR / pt locales had "costsSection": "Costs" (English label) instead
of the Portuguese "Custos". Other section labels in the same block are
left in English intentionally (analytics, monitoring) — they are
project-wide untranslated terms; "Custos" is the established repo
translation for the Costs section title.
Validation:
- npm run typecheck:core: clean
- tests/integration/quota-plans-crud.test.ts: 10/10 pass (includes new
assertion on DELETE → audit event)
- eslint --no-warn-ignored on touched files: clean
Components were created by F4 per master-plan §3.7-§3.9 but never integrated:
the `*ToolCard.tsx` files use the legacy `ManualConfigModal` from
`@/shared/components` (barrel-export root), not the F4 versions in
`@/shared/components/cli`. The 3 files were sitting as dead code.
Removes:
- src/shared/components/cli/BaseUrlSelect.tsx
- src/shared/components/cli/ApiKeySelect.tsx
- src/shared/components/cli/ManualConfigModal.tsx
- tests/unit/ui/BaseUrlSelect.test.tsx
- tests/unit/ui/ApiKeySelect.test.tsx
- tests/unit/ui/ManualConfigModal.test.tsx
Updates `src/shared/components/cli/index.ts` to drop the dead exports.
Kept (actively used by page clients):
- CliToolCard, CliConceptCard, CliComparisonCard
Verified:
- typecheck:core + noimplicit:core clean
- npx eslint src/shared/components/cli/: 0 issues
- check:cycles: clean (212 files, -3 from removed components)
- 50/50 UI tests pass across the 3 kept components + 3 page clients
- 0 residual imports of the 3 removed symbols anywhere in src/ or tests/
Closes code review v3 gap #1 (dead code).
Gap 1 (auditor deep review): `GET /api/memory` was computing hitRate from
memoryCache.stats() but never exposing cacheStats in the response. MemoriesTab
reads `stats.cacheStats` to decide whether to render the Hit Rate card (only
when hits + misses > 0). Without this field the card never appeared even when
hitRate > 0, contradicting plan 21 §7 #6 and bug-fix #5.
Gap 2 (auditor deep review): 8 `tests/unit/ui/*.test.tsx` files created by F7
were orphaned — `test:unit` filters `*.test.ts` only, and `vitest.mcp.config.ts`
does not include `tests/unit/ui/`. Added `test:vitest:ui` script using the
default vitest.config.ts (which already includes `tests/unit/**/*.test.tsx`).
Coverage gate aligned with the effective 40/40/40/40 per user decision.
Plan 21 / D17 — CLI now remaps legacy types (user/feedback/project/reference) to
canonical (factual/episodic/procedural/semantic). The legacy assertion in
cli-memory-commands.test.ts still expected 'user'; update to expect 'factual'.
Also includes incidental .env.example + docs/ENVIRONMENT.md + qdrant
embedding-models route tweaks captured by F10 audit pass.
Pre-existing lint error from F8 commit 2d58519ca9 — the new react-hooks/set-state-in-effect rule conservatively flags any setState within useEffect body, even when setState happens async after Promise resolution. The "load remote data on mount" pattern is canonical until React 19 use()/Suspense migration.
Fix adds cancelled-flag pattern to prevent setState after unmount + block-disable with justification comment. Tests still pass 5/5.
Found during code review v2 deep audit — F10 audit reported "lint 0 errors" but only ran focused lint, not full project (which surfaces ~2985 pre-existing warnings + this 1 new error).
Line 68: {statusCls} string literal → \${statusCls} template literal so status color applies.
Remove duplicate <span> wrapping (lines 71-73) that rendered the icon twice via copy-paste bug.
New component renders a horizontal stacked bar split by allocation weight,
with optional per-key consumed% labels sourced from PoolUsageSnapshot.dimensions[dimensionIndex].perKey.
Returns null when allocations is empty. Uses shared PALETTE of 8 colors.
Added pipelineStepClientRequest/Desc, pipelineStepFormatDetected/Desc,
pipelineStepOpenAIIntermediate/Desc, pipelineStepProviderFormat/Desc,
pipelineStepProviderResponse/Desc, conceptDiagramArrow1-3,
conceptDiagramExampleHub, conceptDiagramHubTooltip,
conceptDiagramSourceTooltip, conceptDiagramTargetTooltip to both
en.json and pt-BR.json.
Extended translator-friendly-i18n-keys.test.ts NEW_KEYS array with all
17 new keys. Test suite now covers 69 keys (was 52) — 172 tests pass.
- tests/unit/custom-cli-config.test.ts: fix ERR_MODULE_NOT_FOUND — stale import path cli-tools → cli-code (regression from F8 git mv, missed by F10 audit because it only ran curated test subset).
- tests/unit/ui/CliAgentsPage.test.tsx: update vi.mock path to current cli-code location (was no-op mock pointing to deleted path).
- tests/unit/ui/CliToolCard.test.tsx: update URL strings /dashboard/cli-tools/claude → /dashboard/cli-code/claude (cosmetic alignment with new routes).
- src/app/(dashboard)/dashboard/cli-code/components/ToolDetailClient.tsx: remove dead case "cliproxyapi" + unused import (no entry in CLI_TOOLS catalog).
- src/app/(dashboard)/dashboard/cli-agents/CliAgentsPageClient.tsx: replace inline div skeleton with shared <CardSkeleton /> for visual consistency with CliCodePageClient.
- src/app/api/cli-tools/{forge,jcode,deepseek-tui,smelt,pi}-settings/route.ts: replace catch (err: any) with catch (err) + (err as NodeJS.ErrnoException).code narrowing (8 instances, eliminates 8 of 11 implicit-any introductions).
Validated: custom-cli-config.test.ts now 3/3 PASS (was 0/1 FAIL with ERR_MODULE_NOT_FOUND); F1/F3 tests 147/147 PASS; UI tests 25/25 PASS; typecheck:core + noimplicit clean.
Add 22 new keys under activity.eventVerb.* in both pt-BR.json and en.json
corresponding to the new ACTIVITY_ICONS i18nKeyVerb values (providerCredentials*,
authLogin*, authLogoutSuccess, syncToken*, settingsUpdate, settingsUpdateFailed,
serviceRevealApiKey). Existing keys preserved for back-compat.
Replace all icon specs to match the new 26 real action names. Every entry in
HIGH_LEVEL_ACTIONS now has a corresponding ACTIVITY_ICONS spec with appropriate
Material Symbols icon and i18nKeyVerb key. Old entries (provider.added, auth.login,
etc.) removed since those actions are no longer in the allowlist.
Replace the old "clean naming" allowlist (provider.added, auth.login, etc.) with
the 26 real action strings emitted by logAuditEvent calls in the codebase
(provider.credentials.*, auth.login.*, settings.update, sync.token.*, etc.).
Activity feed was empty because HIGH_LEVEL_ACTIONS used invented names that
never matched any real audit event.
TranslateTab now accepts onInputChange?(text: string) => void. A unified
handleInputChange wrapper calls both setInputText and onInputChange? so
CompressionPreviewAccordion and pipeline Step 1 at the shell level receive
the real input text instead of always seeing an empty string.
TranslatorPageClient passes onInputChange={setSharedInputContent} to wire
the sync. Test files updated to accept the new optional prop in mocks and
verify the callback is wired without throwing.
TestBenchAccordionProps extends Omit<AdvancedAccordionProps, 'slug'> so slug
is not a valid prop on that component. The slug is fixed internally as
'testbench' — callers must not pass it.
F7 originally implemented useEngineStatus/useMemorySettings via swr, but the
package is not in package.json — would crash at runtime. Replaced with native
useState + useEffect + setInterval polling. Same public API
(status/settings/isLoading/isError/mutate/save) so the existing components
and the 8 UI tests (which mock the hooks directly) keep working unchanged.
Replace MockExportCodeModal stub in SearchToolsTopBar with the real
ExportCodeModal component from playground/components/ExportCodeModal.
Update SearchToolsClient exportState type from Record<string,unknown>
to PlaygroundState for proper type alignment.
Micro-fix detected during F10 audit: F8 left a TODO(F7-merge) stub
that was never resolved after F7 merged.
Export deepMergeFallback and apply it in getRequestConfig so all 39
non-EN locales receive EN text for any key absent in their JSON file.
Locale-specific translations always win; EN fills gaps only.
Add 60 new playground.* keys and 50 new search.* keys to en.json and
pt-BR.json covering Playground Studio tabs (Chat/Compare/API/Build),
config pane, param sliders, presets, improve prompt, export, compare
metrics (TTFT/TPS), Build tab (tools/structured output), and Search Tools
Studio tabs (Search/Scrape/Compare), SearchConceptCard, ProviderCatalog,
ScrapeResult, and config pane fields.
PT-BR has full Portuguese translations. EN has EN strings.
Converts the monolithic memory page into a 3-tab Studio layout
(Memories | Playground | Engine) with URL-driven tab state, 8 new
React components, 2 SWR hooks, 50+ i18n keys, and 8 Vitest unit tests
covering all new components (45/45 passing).
Convert CaptureModesToolbar, TopBarControls, CustomHostsManager,
HttpProxySnippetCard and SessionRecorderBar to consume useTranslations
instead of hardcoded English strings. Add 7 missing trafficInspector
keys (customHostsTitle, loading, copied, copy, httpProxyTitle,
notRecording, anyStatus) to both en.json and pt-BR.json.
