feat: add dashboard thought graph viewer #73
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "phase-8/dashboard-ui-pr4-graph"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
get_thought_graphfor the selected session's deterministic root thought.mermaid.min.js10.9.1 (MIT, 3 335 717 B, SHA25661b335a4…a936d6) under strict security mode with a 256 KiB source cap.graph.js, and bundle-size budget.Phase
Phase 8 — Dashboard UI
Stacked PR [4/7] — merge after #72
Test Plan
cargo build -p cognix-server(no UI feature) succeedscargo build -p cognix-server --features ui,ssesucceedscargo test -p cognix-server --features ui,sse --lib— 381 passedcargo test -p cognix-server --features ui,sse --test ui_graph_routes— 3 passedcargo run -p xtask -- run-ui-tests --features ui— 26 passed across 7 suitescargo clippy -p cognix-server --all-targets --features ui,sse -- -D warningscleancargo fmt --checkcleancargo deny checkcleancargo doc -p cognix-server --features ui,sse --no-depsclean/ui,/ui/assets/{graph.js,mermaid.min.js,THIRD-PARTY-LICENSES.md,styles.css}— all 200, CSP header present, mermaid SHA256 matchesSelf-Review Checklist
unwrap()in library codeprintln!/eprintln!/dbg!get_thought_graph({thought_id, format:'mermaid'})); no demosession_idshapesecurityLevel: 'strict'actually passed tomermaid.initializemermaid.render()graph.jsis the single reviewed exception to the no-innerHTMLrule (uses DOMParser+cloneNode); PR3'stest_no_dangerous_dom_sinksscan list unchangedsessions.jsstill contains noget_thought_graphreference (PR3 invariant)mermaid.min.jsSHA256 + byte-size pinned inTHIRD-PARTY-LICENSES.mdand asserted at test timeNotes
sha2/hexintroduced as dev-dep only.catch (_) {}blocks in graph.js, (4) future split of assets.rs tests by phase. None block merge.PR4 of the dashboard UI stack. Renders Mermaid diagrams from get_thought_graph output for the selected session's deterministic root thought. - Vendor mermaid.min.js (10.9.1, MIT, 3335717 B, SHA256 61b335a46df05a7ce1c98378f60e5f3e77a7fb608a1056997e8a649304a936d6) - Initialize mermaid with securityLevel:'strict' and cap source at 256 KiB - Inject SVG via DOMParser+cloneNode (no innerHTML); single reviewed exception to the safe-rendering ban - Use real MCP contract: get_thought_graph({thought_id, format:'mermaid'}); never the demo session_id shape - Empty-session short-circuits to "No graph (link some thoughts first)" without calling the graph tool when no root thought exists - Register new assets and add 14 unit tests + 3 integration tests covering asset registration, SHA256/byte-size pinning, security config, source cap, empty state, contract enforcement, DOM-sink ban for graph.js, and bundle size budget (excluding mermaid: 41.2 KB, well under 200 KB)