Skip to content

feat(ui): privacy-gated Vision panel + same-origin mutation guard - #5

Open
hermz580 wants to merge 3 commits into
mainfrom
feat/vision-phase-2
Open

hermz580 wants to merge 3 commits into
mainfrom
feat/vision-phase-2

Conversation

@hermz580

@hermz580 hermz580 commented Sep 3, 2026

Copy link
Copy Markdown
Owner

What this adds

Vision panel (Phase 3 of the vision lane) — live posture/activity metrics in the Focus Command Center:

  • /api/vision endpoint: allow-listed metrics-only view of vision_events.jsonl — no frames, no raw data, no path disclosure
  • Status ladder: disabledstoppedwaitingactive / attention / unavailable, with freshness bound (180s)
  • Settings: vision_enabled, vision_sample_interval (30–60s), vision_frame_interval (0.1–5s) — clamped in SettingsStore
  • Assistant launch args now come from persisted settings only (build_assistant_command); consent changes stop the managed assistant
  • Redaction: metrics are hidden entirely while vision is disabled; NaN/Inf never serialize (allow_nan=False)
  • Bounded tail reads (200 lines / 256 KiB) so a growing events file can't stall the dashboard

Mutation guard (hardens the whole command center, not just vision):

  • POST/PATCH/DELETE require same-origin (Origin == Host) + application/json Content-Type; cross-origin → 403, wrong type → 415

Verification

  • 287 passed on merged tree (uv lock --check exit 0)
  • Live probes: cross-origin PATCH rejected (403), same-origin allowed, 415 on text/plain, DELETE cross-origin 403
  • Vision panel renders in-app: OFF state, privacy seal, metrics placeholders
  • Merged origin/main (integration-first-run) with no loss — tutorial/help/effective-streak retained alongside vision panel

Notes

  • Vision runtime itself is CLI opt-in (--vision); the panel is the read-side UI
  • Posture thresholds remain generic/uncalibrated — personal calibration is a separate milestone

- /api/vision endpoint: allow-listed metrics-only view of vision events,
  no frames or raw data, full redaction while vision is disabled
- settings: vision_enabled, vision_sample_interval (30-60s), vision_frame_interval
- build_assistant_command: assistant launch args come from persisted settings only
- mutation guard: POST/PATCH/DELETE require same-origin (Origin==Host)
  and application/json content type for state-changing requests
- _send_json/_send_download: allow_nan=False so non-finite metrics never serialize
- bounded tail reads for the events file (200 lines / 256 KiB cap)
- Vision panel UI (posture + activity metrics, privacy seal, attention pulse)
- tests: payload allow-listing, NaN/Inf rejection, redaction, clamp ranges,
  mutation guard, consent persistence, panel assets
# Conflicts:
#	FOCUS_COMMAND_CENTER.md
#	README.md
#	deep_work_assistant/cli.py
#	deep_work_assistant/ui/app.v2.css
#	deep_work_assistant/web_ui_v2.py
#	tests/test_web_ui_v2.py
#	uv.lock
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant