Feat/v512 monitoring mcp - #233
Merged
Merged
Conversation
…and add grants\n\n- supabase/config.toml: include pmoves_core, pmoves_kb in [api.schemas]\n- new migration: pmoves/db/v5_13_pmoves_core_rest_grants.sql (USAGE/SELECT for anon/authenticated/service_role)\n- docs: update SMOKETESTS/LOCAL_DEV/Jellyfin+PMOVES.YT guides to default to /rest/v1 and note PostgREST as optional fallback\n- docs index/services readme: link to unified REST notes\n\nRefs: Stabilization sprint, unify REST surface before broader smokes
…ent Zero dirs\n\n- tools/brand_defaults.py: generate strong defaults (NEO4J_AUTH, MEILI, Invidious, MinIO buckets, Supabase REST vars) and stamp .env.generated\n- scripts/with-env.sh: unified, safe env sourcing for all bash scripts\n- tailscale brand helpers: init/up scripts with branded defaults\n- docs: ENVIRONMENT_POLICY, SCRIPTS_ENV, SECURITY_SINGLE_USER\n- add Agent Zero runtime directories (.gitkeep) to ensure persistence mounts exist\n\nRefs: Stabilization sprint – eliminate env drift and whack‑a‑mole
…Advisor\n\n- Add compose bundle and configs under pmoves/monitoring\n- Starter Grafana dashboard and datasource provisioning\n- Blackbox HTTP probes targeting core services\n- Operator helper script monitoring_report.py\n- Docs: services/monitoring/README with quickstart and make targets\n\nRefs: ROADMAP ‘observability baseline’, Stabilization sprint
…or YTDLP_VERSION; prepare for GHCR tags\n- requirements: decouple yt-dlp pin; upgrade paths\n- yt.py: SABR/nsig fallback to Invidious/Companion, offline transcript prefetch, REST precedence (SUPABASE_REST_URL)\n- README/docs: workflow summary and Jellyfin integration updated\n\nRefs: Stabilization sprint – downloader resilience, reproducible builds
…ts\n\n- Fix videos dashboard realtime init order; eliminate ‘refresh before init’\n- Presign client retry + /api/health/presign diagnostic endpoint\n- Monitor and Notebook panels; chat stub APIs\n- Supabase server/client: explicit keys for middleware edge env\n- Playwright E2E for videos realtime; with-env.mjs env layering\n\nRefs: UI stabilization, smoke coverage
…optional hosts-compose for Jellyfin AI overlay and host mapping file\n- Helper script to generate Jellyfin mounts\n- Enhanced Jellyfin smoketest script\n\nRefs: Jellyfin Bridge integration runbook
…ocs\n\n- Makefile: first-run, smokes, monitoring targets; GPU/CPU port parametrization\n- docker-compose: env_file alignment, Agent Zero volume, Neo4j auth via .env.generated only\n- agents images/integrations compose updates\n- CI: integrations GHCR workflow tweaks\n- Docs: CI images + local tooling reference updates\n\nRefs: Stabilization sprint – reduce service/env drift
…i tweaks\n\n- docs/ARC/network_fabric.md: internal service mesh and ports map\n- scripts: ui_videos_realtime_smoke.sh + cleanup using unified env loader\n- tools/mini_cli.py: helpers for local ops\n\nRefs: Stabilization – operator ergonomics
…defaults\n\n- hi‑rag v2 README: document stable GHCR GPU image override and cu128 torch pin\n- env.shared.example: add LANGEXTRACT_PROVIDER, agent UIs, SINGLE_USER_MODE, PMOVES.YT image, monitoring ports, Qwen2‑Audio/Gemma toggles\n- add docker-compose.gpu-image.yml override file
…and docs\n\n- Makefile: add tailscale-save-key/join/rejoin/status/logout; hook optional auto-join into first-run\n- env.shared.example: add Tailscale variables (AUTO_JOIN, TAGS, HOSTNAME, routes, sign)\n- ENVIRONMENT_POLICY: document tailnet join, key storage, and rotation paths
…oin commands invoking brand init\n- ARC docs: Tailscale overlay/admin guards quickstart
… API auth env_file wiring\n\n- yt-emit-smoke: resolve point id via REST with retry; fallback to legacy id; final fallback validates via /hirag/query\n- n8n: read tokens from env.shared via env_file and enable API auth flags
…rument counters; docs
… gate cAdvisor; fix Grafana mounts
…e env block; Makefile tidy
Contributor
|
Warning Rate limit exceeded@POWERFULMOVES has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 6 minutes and 27 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (89)
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughThis PR introduces comprehensive infrastructure upgrades including Single-User Mode with boot JWT authentication, a complete Monitoring stack (Prometheus/Grafana/Loki), Tailscale networking integration, Agent UI components, expanded integration publishing, MCP bridging, and numerous operational Make targets. Multiple new backend/frontend features, SQL migrations, and configuration systems are introduced. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant UI as PMOVES UI<br/>(Port 3001)
participant Boot as Boot JWT<br/>Handler
participant Supabase
participant Chat as Chat API<br/>(/api/chat/*)
User->>UI: Load Chat Dashboard
UI->>Boot: Check boot JWT
Boot-->>UI: JWT valid + ownerId
Note over UI: Owner mode active
UI->>Chat: GET /api/chat/messages
Chat->>Supabase: SELECT messages<br/>WHERE owner_id = ?
Supabase-->>Chat: Chat history
Chat-->>UI: Messages array
User->>UI: Type message
UI->>Chat: POST /api/chat/send
Chat->>Supabase: INSERT chat_message<br/>(owner_id, content, role)
Supabase-->>Chat: Created record
Chat-->>UI: Message sent
Note over UI: Poll every 3s
UI->>Chat: GET /api/chat/messages
Chat-->>UI: Updated history
UI->>UI: Render new message
sequenceDiagram
participant Make
participant Tailscale as Tailscale Init<br/>Scripts
participant Tailnet as PMOVES Tailnet
participant System as systemctl
Make->>Tailscale: make tailscale-join
Tailscale->>Tailscale: Read TAILSCALE_AUTHKEY
alt TAILSCALE_SIGN_AUTHKEY enabled
Tailscale->>Tailscale: Sign auth key<br/>via tailscale lock sign
Tailscale->>Tailscale: Write signed key<br/>with 0600 perms
end
Tailscale->>System: systemctl start tailscaled
System-->>Tailscale: Service ready
Tailscale->>Tailnet: tailscale up --auth-key
Tailnet-->>Tailscale: Join confirmation<br/>+ BackendState
Tailscale->>Tailscale: Record sentinel<br/>+ timestamp
Tailscale-->>Make: Join complete
Note over Make: Idempotent: sentinel<br/>prevents re-join
sequenceDiagram
participant Make
participant Monitor as Monitoring Stack<br/>(docker-compose)
participant Prometheus
participant Blackbox
participant Services as pmoves<br/>Services
Make->>Monitor: make up-monitoring
Monitor->>Monitor: Start Prometheus:9090
Monitor->>Monitor: Start Grafana:3000
Monitor->>Monitor: Start Loki:3100
Monitor->>Monitor: Start Promtail
Monitor->>Monitor: Start Blackbox:9115
Prometheus->>Prometheus: Load scrape configs
par HTTP Health Probes
Prometheus->>Blackbox: Probe /module=http_2xx
Blackbox->>Services: GET /healthz (various ports)
Services-->>Blackbox: 2xx responses
Blackbox-->>Prometheus: probe_success=1
and Container Metrics
Prometheus->>Services: Scrape cadvisor:8080
Services-->>Prometheus: container_cpu_usage_seconds_total
and Log Collection
Prometheus->>Loki: Scrape logs via Promtail
Loki-->>Prometheus: Log metrics
end
Note over Prometheus: Metrics aggregated<br/>15s interval
Prometheus->>Monitor: Update dashboards
Estimated code review effort🎯 4 (Complex) | ⏱️ ~75 minutes Areas requiring extra attention:
Possibly related PRs
Suggested labels
Poem
Note Free review on us!CodeRabbit is offering free reviews until Fri Nov 07 2025 to showcase some of the refinements we've made. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+17
to
+29
| export async function GET(req: NextRequest) { | ||
| const supabase = getServiceSupabaseClient(); | ||
| const owner = ownerFromJwt(); | ||
| const ownerId = owner || req.nextUrl.searchParams.get('ownerId'); | ||
| if (!ownerId) return NextResponse.json({ items: [] }); | ||
| const { data, error } = await supabase | ||
| .from('chat_messages') | ||
| .select('id,role,agent,avatar_url,content,created_at') | ||
| .eq('owner_id', ownerId) | ||
| .order('created_at', { ascending: false }) | ||
| .limit(50); | ||
| if (error) return NextResponse.json({ error: error.message }, { status: 500 }); | ||
| return NextResponse.json({ items: data ?? [] }); |
There was a problem hiding this comment.
The new GET /api/chat/messages handler queries Supabase with a service‑role client and accepts an ownerId from the query string when a boot JWT is not present. Because this route is publicly accessible in the Next.js app and no session or shared secret is checked, any unauthenticated caller can supply an arbitrary ownerId and fetch up to 50 messages bypassing the row‑level security policies. This exposes private chat content and should gate the endpoint behind a verified Supabase session or other auth mechanism before using the service role key.
Useful? React with 👍 / 👎.
Comment on lines
+17
to
+31
| export async function POST(req: NextRequest) { | ||
| const supabase = getServiceSupabaseClient(); | ||
| const body = await req.json().catch(() => ({})); | ||
| let { content, role, agent, avatar_url, ownerId } = body as any; | ||
| if (!ownerId) ownerId = ownerFromJwt(); | ||
| if (!ownerId) return NextResponse.json({ error: 'ownerId missing' }, { status: 400 }); | ||
| if (!content || typeof content !== 'string') return NextResponse.json({ error: 'content required' }, { status: 400 }); | ||
| role = role || 'user'; | ||
| const { data, error } = await supabase | ||
| .from('chat_messages') | ||
| .insert([{ owner_id: ownerId, content, role, agent, avatar_url }]) | ||
| .select('id,role,agent,avatar_url,content,created_at') | ||
| .single(); | ||
| if (error) return NextResponse.json({ error: error.message }, { status: 500 }); | ||
| return NextResponse.json({ ok: true, message: data }); |
There was a problem hiding this comment.
The new POST /api/chat/send endpoint inserts rows into chat_messages using a service‑role client but allows ownerId to be provided in the request body and performs no authentication check. In the default single‑user setup any external caller can invoke this route to create messages for arbitrary owners, effectively granting public write access to a table that is supposed to be guarded by RLS. The handler should validate the request against an authenticated Supabase session or reject unauthenticated calls before using the service key.
Useful? React with 👍 / 👎.
This was referenced Dec 8, 2025
This was referenced Dec 16, 2025
This was referenced Dec 28, 2025
POWERFULMOVES
added a commit
that referenced
this pull request
Jan 18, 2026
Feat/v512 monitoring mcp
This was referenced Feb 22, 2026
This was referenced Mar 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Title: v5.12 Stabilization: Monitoring + Channel Monitor metrics, Archon MCP wiring, UI defaults
Summary
/healthzand scrapes metrics; Grafana provision/mount paths fixed; dashboard shows channel-monitor panels.archon-server:8091API inside Docker./mcp/describeshim to report MCP bridge status in JSON.Key Files
pmoves/services/channel-monitor/channel_monitor/main.py,requirements.txt,README.mdpmoves/monitoring/prometheus/prometheus.yml,pmoves/monitoring/docker-compose.monitoring.yml,pmoves/monitoring/grafana/*pmoves/docker-compose.yml,pmoves/docker-compose.agents.images.yml,pmoves/docker-compose.agents.integrations.yml,pmoves/AGENTS.mdpmoves/tools/seed_agent_zero_mcp.py,pmoves/Makefile(a0-mcp-seed, archon-mcp-smoke, archon-ui-smoke)pmoves/docs/SMOKETESTS.md,pmoves/docs/services/monitoring/README.md,pmoves/docs/context/pmoves_v_5.12_tasks.mdHow to Verify
docker compose -p pmoves up -d --build channel-monitorcurl http://localhost:8097/healthz→ 200curl http://localhost:8097/metrics→ Prometheus textMON_INCLUDE_CADVISOR=true make -C pmoves up-monitoringmake -C pmoves up-agents-uicurl http://localhost:8091/healthz→ 200make -C pmoves archon-ui-smoke→ API/UI 200smake -C pmoves archon-mcp-smoke→ prints HTTP code for :8051 (404 acceptable)curl http://localhost:8091/mcp/describe→ JSON with endpoint + probe statusesA0_MCP_SERVERSinpmoves/env.shared(examples inenv.shared.example)make -C pmoves a0-mcp-seed→ writes runtime mapping topmoves/data/agent-zero/runtime/mcp/servers.envReviewer Notes
/mcp/describeensures we can assert liveness without knowing the exact route shape.@codex review
Summary by CodeRabbit
Release Notes
New Features
Improvements