chore: sync latest code from Bitbucket master-v1 (full mirror)

.dockerignore

@@ -52,7 +52,13 @@ apps/web-ui-e2e
 .env.*
 
 # ── Test and tooling artefacts ──────────────────────────────────────────────
-**/coverage
+# NOT `**/coverage`: that matches a directory of that name at any depth, which also
+# excluded app/api/scaling-audit/coverage/route.ts — a real API route. It was then
+# missing from every built image and 404'd wherever it was deployed. Coverage output
+# only lands at a project root, so match it there.
+/coverage
+apps/*/coverage
+libs/*/coverage
 **/.nyc_output
 **/test-results
 **/playwright-report

.github/workflows/ci.yml

@@ -46,8 +46,53 @@ jobs:
         run: bun run lint
         continue-on-error: true
 
-      # Non-blocking until the mock-harness failures in the agent test suite
-      # are fixed. Remove continue-on-error once the suite is green.
+      # DB-free unit suite (the 3-4 real Postgres integration suites are
+      # describe.skipIf'd without DATABASE_URL — see the `coverage` job below
+      # for those plus the coverage report).
       - name: Test
         run: bun run test
-        continue-on-error: true
+
+  coverage:
+    name: Coverage (unit + Postgres integration)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    services:
+      postgres:
+        image: pgvector/pgvector:pg16
+        env:
+          POSTGRES_DB: nucleus
+          POSTGRES_USER: nucleus
+          POSTGRES_PASSWORD: nucleus_dev
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U nucleus -d nucleus"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+
+    env:
+      DATABASE_URL: postgresql://nucleus:nucleus_dev@localhost:5432/nucleus?connection_limit=10
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.2.12
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Apply migrations
+        run: |
+          prisma migrate deploy --schema=./libs/prisma/schema.prisma
+          prisma db execute --file ./libs/prisma/ensure-vector-indexes.sql --schema=./libs/prisma/schema.prisma
+
+      - name: Test + coverage
+        run: bun run test:coverage

CLAUDE.md

@@ -208,7 +208,7 @@ export const myTool = tool(
 Background jobs run in `workers/` as a single Node.js process using pg-boss:
 
 - `workers/src/jobs/scheduler/` — resource start/stop scheduling
-- `workers/src/jobs/discovery/` — multi-account resource scanning
+- `workers/src/jobs/discovery/` — multi-account resource scanning; also derives the resource dependency graph (`resource_edges`) from raw describe responses via `services/edge-spec.ts` + `services/edge-extractor.ts`. Web-ui side: `lib/db/repositories/resource-graph/`, agent tools `get_resource_neighbors` / `get_blast_radius`. See `docs/RESOURCE_GRAPH_ARCHITECTURE.md`.
 - `workers/src/jobs/right-sizing/` — CloudWatch-based right-sizing analysis: per-tenant fan-out scan + weekly pricing refresh. Pure engine + per-type rules (EC2/RDS/EBS/ASG) under `services/`+`rules/`; raw-pg writers (manually tenant-scoped). Gated by `RIGHT_SIZING_ENABLED`. Web-ui side: `/api/right-sizing/*`, `lib/right-sizing-service.ts`, `RightSizing` RBAC subject (→ Inventory module), models `RightSizingRecommendation`/`RightSizingRun`/`PricingCatalogEntry` (the last is global, not tenant-scoped)
 - `workers/src/jobs/kb-sync/` — knowledge base sync (S3, Bitbucket, Confluence)
 - Workers use `createLogger('service-name')` from `workers/src/lib/logger.ts` — not raw `console`
@@ -253,7 +253,10 @@ the old Python discovery Lambda was rewritten in TypeScript. Job dirs:
 
 - **web-ui**: `cd apps/web-ui && bun run test` — runs Vitest once (`vitest run`, not watch mode)
 - **workers**: `cd apps/workers && bun run test` — Vitest
-- **root**: `npm test` at root — Jest with ts-jest
+- **root**: `bun run test` at root — `nx run-many -t test --all` across web-ui, workers, libs/rbac (no Jest config exists anywhere in the repo; `jest`/`ts-jest`/`@types/jest` are unused root devDependencies)
+- **Known pre-existing timing sensitivity**: a small number of tests (e.g. `apps/workers/src/executor/horizontal.test.ts`, which polls on genuine `setTimeout` rather than `vi.useFakeTimers()` — a deliberate choice per its own comment, to avoid fake-timer async-ordering issues) assume generous real-clock margins and can occasionally flake under added CPU overhead: confirmed reproducible via Nx's `nx:run-commands` executor (`nx run workers:test`, and therefore the root `bun run test`/`test:coverage`/`test:integration` — NOT fixed by `--parallel=1`, so it isn't cross-project contention; root cause not fully isolated, suspect stdio-piping overhead) and, separately, under `--coverage`'s v8 instrumentation overhead (observed once on an unrelated agent-ops-scheduler timing test, not reproducible on immediate re-run). Every project's suite is 100% green natively (`cd apps/<project> && bun run test`, verified repeatedly) — if a timing-sensitive test flakes in CI, retry once before assuming a real regression, and consider fake timers or wider margins as a follow-up rather than distrusting the rest of the suite.
+- **Coverage**: `bun run test:coverage` at root (or per-project `test:coverage`) — Vitest `--coverage` via `@vitest/coverage-v8`, configured in each project's `vitest.config.ts`
+- **DB-backed integration tests**: files named `*.integration.test.ts` are `describe.skipIf(!DATABASE_URL)`'d — they no-op in a DB-free run and only execute when `DATABASE_URL` is set (`docker compose up -d postgres` + `bun run db:migrate:deploy`, or `bun run test:integration` at root). web-ui's `vitest.config.ts` snapshots `DATABASE_URL`'s presence once via Vite `define` (`__HAS_DB__`) rather than reading `process.env.DATABASE_URL` live in each test file — constructing a real `PrismaClient` triggers Prisma's own `.env` auto-load as a side effect, which would otherwise leak a truthy `DATABASE_URL` into later test files in the same worker
 - Test files: `*.test.ts` colocated with source or in `tests/`/`__tests__/` subdirectory
 - Property-based tests use `fast-check` (see `apps/web-ui/tests/agent-ops/`)
 
@@ -430,7 +433,7 @@ What `pulumi up` does automatically (change detection = recursive sha256 of the
 
 ### Post-Deploy Verification
 
-1. CloudFront URL responds 200: `https://d11lr8aqp8vqde.cloudfront.net`
+1. CloudFront URL responds: `https://d2o00a2uwp9po0.cloudfront.net` (`/` returns 307 to `/app/dashboard` when signed out)
 2. ECS services (web-ui + workers) desired count matches running count (ECS console)
 3. Check CloudWatch ECS task logs for errors in the 5 minutes post-deploy
 4. Run smoke test: `bun run e2e` (runs `apps/web-ui-e2e` Playwright suite)
@@ -494,9 +497,9 @@ Active constraints:
 - `@prisma/client` - PostgreSQL ORM (web-ui + workers)
 - mongodb ^7.1.0 - MongoDB client (deep agent checkpointing)
 - `@langchain/langgraph-checkpoint-mongodb` ^1.2.0 - LangGraph MongoDB checkpointer
-- Vitest ^4.0.18 (web-ui + workers) - Unit tests
-- Jest ^29.7.0 + ts-jest ^29.2.5 (root) - Root-level tests
-- `@vitest/coverage-v8` ^4.0.18 - Coverage reporting
+- Vitest ^4.0.18 (web-ui, libs/rbac) / ^2.1.8 (workers, pinned separately) - Unit tests
+- Jest ^29.7.0 + ts-jest ^29.2.5 (root devDependencies) - unused; no jest config exists anywhere in the repo
+- `@vitest/coverage-v8` ^4.0.18 (web-ui, libs/rbac) / ^2.1.8 (workers) - Coverage reporting, version-matched to each project's own vitest
 - fast-check ^4.5.3 - Property-based testing
 - Playwright ^1.58.2 - E2E browser tests
 - ts-node ^10.9.2 - TypeScript execution (scripts, local runners)
@@ -671,19 +674,6 @@ Active constraints:
 ## Cross-Cutting Concerns
 <!-- GSD:architecture-end -->
 
-<!-- GSD:workflow-start source:GSD defaults -->
-## GSD Workflow Enforcement
-
-Before using Edit, Write, or other file-changing tools, start work through a GSD command so planning artifacts and execution context stay in sync.
-
-Use these entry points:
-- `/gsd:quick` for small fixes, doc updates, and ad-hoc tasks
-- `/gsd:debug` for investigation and bug fixing
-- `/gsd:execute-phase` for planned phase work
-
-Do not make direct repo edits outside a GSD workflow unless the user explicitly asks to bypass it.
-<!-- GSD:workflow-end -->
-
 <!-- GSD:profile-start -->
 ## Developer Profile
 

NOTES.md

@@ -1,4 +1,4 @@
-# NOTES — engineering scratchpad
+# NOTES — Dipanshu's world
 
 Raw notes on tools, channels and terminology. Seeded from facts verified in-repo on 2026-07-30; decisions still open are marked **[OPEN]**.
 

apps/web-ui/app/api/accounts/[accountId]/activity/route.test.ts

@@ -0,0 +1,71 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@/lib/auth-session', () => ({ getSessionTenantId: vi.fn() }));
+vi.mock('@/lib/audit-service', () => ({ AuditService: { getAuditLogs: vi.fn() } }));
+vi.mock('@/lib/schedule-execution-service', () => ({ ScheduleExecutionService: { getRecentExecutions: vi.fn() } }));
+
+import { getSessionTenantId } from '@/lib/auth-session';
+import { AuditService } from '@/lib/audit-service';
+import { ScheduleExecutionService } from '@/lib/schedule-execution-service';
+import { GET } from './route';
+
+const makeParams = (accountId: string) => ({ params: Promise.resolve({ accountId }) });
+const makeRequest = () => ({ url: 'http://localhost/api/accounts/acc-1/activity' }) as any;
+
+describe('GET /api/accounts/[accountId]/activity', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.mocked(getSessionTenantId).mockResolvedValue('tenant-1');
+    });
+
+    it('returns 400 when accountId is missing', async () => {
+        const res = await GET(makeRequest(), makeParams(''));
+        expect(res.status).toBe(400);
+    });
+
+    it('merges and sorts audit logs and schedule executions filtered to this account', async () => {
+        vi.mocked(AuditService.getAuditLogs).mockResolvedValue({
+            logs: [
+                { id: 'l1', accountId: 'acc-1', timestamp: '2026-01-01T00:00:00Z', action: 'a', details: 'd', status: 'success', resourceType: 'Account', resource: 'r' },
+                { id: 'l2', accountId: 'other', timestamp: '2026-01-02T00:00:00Z', action: 'a', status: 'success' },
+            ],
+        } as any);
+        vi.mocked(ScheduleExecutionService.getRecentExecutions).mockResolvedValue([
+            { executionId: 'e1', accountId: 'acc-1', executionTime: '2026-01-03T00:00:00Z', status: 'success', resourcesStarted: 2, resourcesStopped: 1, resourcesFailed: 0, scheduleId: 'sched-1', duration: 10 },
+            { executionId: 'e2', accountId: 'other', executionTime: '2026-01-04T00:00:00Z', status: 'success' },
+        ] as any);
+
+        const res = await GET(makeRequest(), makeParams('acc-1'));
+        const body = await res.json();
+
+        expect(res.status).toBe(200);
+        expect(body.accountId).toBe('acc-1');
+        expect(body.total).toBe(2);
+        expect(body.activity[0].id).toBe('e1');
+        expect(body.activity[1].id).toBe('l1');
+    });
+
+    it('matches logs by metadata.accountId and by resourceId containing the accountId', async () => {
+        vi.mocked(AuditService.getAuditLogs).mockResolvedValue({
+            logs: [
+                { id: 'l1', timestamp: '2026-01-01T00:00:00Z', action: 'a', status: 'success', metadata: { accountId: 'acc-1' } },
+                { id: 'l2', timestamp: '2026-01-02T00:00:00Z', action: 'a', status: 'success', resourceId: 'account/acc-1/thing' },
+                { id: 'l3', timestamp: '2026-01-03T00:00:00Z', action: 'a', status: 'success' },
+            ],
+        } as any);
+        vi.mocked(ScheduleExecutionService.getRecentExecutions).mockResolvedValue([]);
+
+        const res = await GET(makeRequest(), makeParams('acc-1'));
+        const body = await res.json();
+
+        expect(body.total).toBe(2);
+        expect(body.activity.map((a: any) => a.id).sort()).toEqual(['l1', 'l2']);
+    });
+
+    it('returns 500 when a dependency throws', async () => {
+        vi.mocked(AuditService.getAuditLogs).mockRejectedValue(new Error('DB down'));
+        vi.mocked(ScheduleExecutionService.getRecentExecutions).mockResolvedValue([]);
+        const res = await GET(makeRequest(), makeParams('acc-1'));
+        expect(res.status).toBe(500);
+    });
+});

apps/web-ui/app/api/accounts/[accountId]/resources/route.test.ts

@@ -0,0 +1,46 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@/lib/auth-session', () => ({ getSessionTenantId: vi.fn() }));
+vi.mock('@/lib/schedule-service', () => ({ ScheduleService: { getSchedules: vi.fn() } }));
+
+import { getSessionTenantId } from '@/lib/auth-session';
+import { ScheduleService } from '@/lib/schedule-service';
+import { GET } from './route';
+
+const makeParams = (accountId: string) => ({ params: Promise.resolve({ accountId }) });
+const makeRequest = () => ({ url: 'http://localhost/api/accounts/acc-1/resources' }) as any;
+
+describe('GET /api/accounts/[accountId]/resources', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.mocked(getSessionTenantId).mockResolvedValue('tenant-1');
+    });
+
+    it('returns 400 when accountId is missing', async () => {
+        const res = await GET(makeRequest(), makeParams(''));
+        expect(res.status).toBe(400);
+    });
+
+    it('scopes the query by tenantId and aggregates unique resources across schedules', async () => {
+        vi.mocked(ScheduleService.getSchedules).mockResolvedValue({
+            schedules: [
+                { name: 'sched-a', resources: [{ id: 'r1', type: 'ec2', name: 'R1' }] },
+                { name: 'sched-b', resources: [{ id: 'r1', type: 'ec2', name: 'R1' }, { id: 'r2', type: 'rds', name: 'R2' }] },
+            ],
+        } as any);
+
+        const res = await GET(makeRequest(), makeParams('acc-1'));
+        const body = await res.json();
+
+        expect(ScheduleService.getSchedules).toHaveBeenCalledWith({ accountId: 'acc-1', tenantId: 'tenant-1' });
+        expect(res.status).toBe(200);
+        expect(body.total).toBe(2);
+        expect(body.resources.find((r: any) => r.id === 'r1').schedules).toEqual(['sched-a', 'sched-b']);
+    });
+
+    it('returns 500 when the service throws', async () => {
+        vi.mocked(ScheduleService.getSchedules).mockRejectedValue(new Error('DB down'));
+        const res = await GET(makeRequest(), makeParams('acc-1'));
+        expect(res.status).toBe(500);
+    });
+});

apps/web-ui/app/api/accounts/[accountId]/scan/route.test.ts

@@ -0,0 +1,37 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@/lib/auth-session', () => ({ getSessionTenantId: vi.fn() }));
+vi.mock('@/lib/account-service', () => ({ AccountService: { scanResources: vi.fn() } }));
+
+import { getSessionTenantId } from '@/lib/auth-session';
+import { AccountService } from '@/lib/account-service';
+import { GET } from './route';
+
+const makeParams = (accountId: string) => ({ params: Promise.resolve({ accountId }) });
+const makeRequest = () => ({ url: 'http://localhost/api/accounts/acc-1/scan' }) as any;
+
+describe('GET /api/accounts/[accountId]/scan', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.mocked(getSessionTenantId).mockResolvedValue('tenant-1');
+    });
+
+    it('scans resources scoped to the session tenant', async () => {
+        vi.mocked(AccountService.scanResources).mockResolvedValue({ ec2: 3 } as any);
+
+        const res = await GET(makeRequest(), makeParams('acc-1'));
+        const body = await res.json();
+
+        expect(AccountService.scanResources).toHaveBeenCalledWith('acc-1', 'tenant-1');
+        expect(res.status).toBe(200);
+        expect(body).toEqual({ success: true, data: { ec2: 3 } });
+    });
+
+    it('returns 500 when scanning fails', async () => {
+        vi.mocked(AccountService.scanResources).mockRejectedValue(new Error('AssumeRole failed'));
+        const res = await GET(makeRequest(), makeParams('acc-1'));
+        const body = await res.json();
+        expect(res.status).toBe(500);
+        expect(body.error).toBe('AssumeRole failed');
+    });
+});

apps/web-ui/app/api/accounts/[accountId]/schedules/route.test.ts

@@ -0,0 +1,40 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@/lib/auth-session', () => ({ getSessionTenantId: vi.fn() }));
+vi.mock('@/lib/schedule-service', () => ({ ScheduleService: { getSchedules: vi.fn() } }));
+
+import { getSessionTenantId } from '@/lib/auth-session';
+import { ScheduleService } from '@/lib/schedule-service';
+import { GET } from './route';
+
+const makeParams = (accountId: string) => ({ params: Promise.resolve({ accountId }) });
+const makeRequest = () => ({ url: 'http://localhost/api/accounts/acc-1/schedules' }) as any;
+
+describe('GET /api/accounts/[accountId]/schedules', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.mocked(getSessionTenantId).mockResolvedValue('tenant-1');
+    });
+
+    it('returns 400 when accountId is missing', async () => {
+        const res = await GET(makeRequest(), makeParams(''));
+        expect(res.status).toBe(400);
+    });
+
+    it('fetches schedules scoped by accountId and tenantId', async () => {
+        vi.mocked(ScheduleService.getSchedules).mockResolvedValue({ schedules: [{ id: 's1' }], total: 1 } as any);
+
+        const res = await GET(makeRequest(), makeParams('acc-1'));
+        const body = await res.json();
+
+        expect(ScheduleService.getSchedules).toHaveBeenCalledWith({ accountId: 'acc-1', tenantId: 'tenant-1' });
+        expect(res.status).toBe(200);
+        expect(body).toEqual({ schedules: [{ id: 's1' }], total: 1, accountId: 'acc-1' });
+    });
+
+    it('returns 500 when the service throws', async () => {
+        vi.mocked(ScheduleService.getSchedules).mockRejectedValue(new Error('DB down'));
+        const res = await GET(makeRequest(), makeParams('acc-1'));
+        expect(res.status).toBe(500);
+    });
+});