build: pin postcss to resolve high-severity path-traversal advisory

[francisprecious061]

closes #364

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added a Prometheus-compatible /metrics endpoint for the Roadmap list.
  • Metrics can reflect current database state when requested.
• Bug Fixes
  • Improved monitoring and daemon-cycle handling to support more reliable metric collection and scheduled operations.
• Documentation
  • Updated project documentation to describe the new metrics endpoint.

Walkthrough

The change documents and declares a Prometheus /metrics endpoint, modifies daemon and monitoring cycle execution, adds a PostCSS npm override, and adds a Vitest import.

Changes

Application runtime and metrics

Layer / File(s)	Summary
Metrics contract and daemon startup README.md, src/observability/server.ts, src/daemon/loop.ts, tests/observability/server.test.ts	The roadmap documents /metrics. createMetricsServer receives a database parameter declaration. Daemon startup and observability test imports receive additional lines.
Duplicate cycle processing src/core/monitor.ts, src/daemon/loop.ts	The monitor runs auto-extensions twice. The daemon adds duplicate monitor execution, cost aggregation, and poll-interval resolution logic.

Dependency resolution

Layer / File(s)	Summary
PostCSS override configuration package.json	The npm configuration pins postcss to ^8.5.18.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• AbdulmalikAlayande/sorokeep#309: Modifies runMonitorCycle behavior in the same monitoring component.
• AbdulmalikAlayande/sorokeep#540: Covers reusable metrics computation and Prometheus formatting for the same observability functionality.
• AbdulmalikAlayande/sorokeep#603: Adds a PostCSS override in package.json.

Suggested reviewers: abdulmalikalayande

Poem

A rabbit watched the metrics glow,
While cycles ran in double flow.
PostCSS found a newer pin,
Vitest gained an import within.
“Hop carefully through every change!”

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The postcss override addresses the target, but unrelated source, README, and test changes violate the dependency-only scope; audit results are not verifiable.	Remove unrelated changes and retain only package.json plus regenerated package-lock.json; then verify npm audit and the full test suite.
Out of Scope Changes check	⚠️ Warning	The PR adds unrelated changes to monitor, daemon, observability, README, and test files beyond the dependency-only objective.	Remove all unrelated source, README, and test changes from the PR.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes pinning postcss to resolve the reported security advisory.
Description check	✅ Passed	The description references linked issue #364, which is related to the dependency security change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Biome (2.5.5)

src/observability/server.ts

File contains syntax errors that prevent linting: Line 120: Expected a statement but instead found '* metric is recomputed from the live database on each scrape, and

• /readyz; Line 121: unterminated string literal; Line 122: Decorators are not valid here.; Line 122: Expected a semicolon or an implicit semicolon after a statement, but found none; Line 122: Expected a semicolon or an implicit semicolon after a statement, but found none; Line 122: Expected a semicolon or an implicit semicolon after a statement, but found none; Line 122: Expected a semicolon or an implicit semicolon after a statement, but found none; Line 122: Expected a semicolon or an implicit semicolon after a statement, but found none; Line 122: unterminated regex literal; Line 123: Expected a semicolon or an implicit semicolon after a statement, but found none; Line 123: Expected a semicolon or an implicit semicolon after a statement, but found none; Line 123: Expected a semicolon or an implicit semicolon after a statement, but found none; Line 123: expected , but instead found lightweight; Line 123: expected , but instead found getCurrentLedger; Line 123: expected , but instead found call; Line 124: Expected an identifier but instead found '*'.; Line 124: unterminated regex literal; Line 125: Illegal use of an export declaration not at the top level; Line 210: Illegal use of an export declaration not at the top level; Line 227: expected } but instead the file ends

src/daemon/loop.ts

File contains syntax errors that prevent linting: Line 117: Expected a catch clause but instead found 'export'.; Line 309: expected } but instead the file ends

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

Warning

⚠️ This pull request has been flagged as potential spam (gibberish) by CodeRabbit slop detection and should be reviewed carefully.

[coderabbitai]

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Line 698: Remove the duplicate Prometheus /metrics roadmap entry from the
README, keeping the corresponding entry that links to the Observability Setup
Guide.

In `@src/core/monitor.ts`:
- Around line 140-161: Remove the duplicate auto-extension invocation block
around runAutoExtensions, including its result assignments and logging, so each
monitor cycle calls runAutoExtensions only once. Preserve the earlier invocation
and its extension state, counts, errors, and anomaly handling.

In `@src/daemon/loop.ts`:
- Around line 203-208: Remove the first try/catch block invoking
aggregateDailyCostSnapshots in the daemon cycle, while retaining the later
aggregation block so the operation runs exactly once per cycle.
- Around line 297-308: Remove the duplicate resolvePollIntervalMs declaration
from the daemon loop, retaining only one implementation with the existing
contract filtering and fallback behavior so TypeScript compilation succeeds.
- Line 162: In the monitor loop around runMonitorCycle, remove the outer
tracing-first result declaration and retain only the non-traced monitor-cycle
invocation so result is declared once in the same scope.
- Around line 81-88: Remove the incomplete metrics-server fragment beginning at
the options.metricsPort check, including its unmatched try and
createMetricsServer call, while preserving the complete metrics-server block
later in the daemon startup flow. Ensure the surrounding initialization in the
daemon loop remains syntactically valid.

In `@src/observability/server.ts`:
- Around line 117-119: Remove the stale bodyless createMetricsServer declaration
immediately before the implementation, leaving the valid three-argument overload
and its implementation intact.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e44acaf5-c4b8-4bd3-b8a5-23f38adf5387

📥 Commits

Reviewing files that changed from the base of the PR and between 1e4a880 and 8d1fa29.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

• README.md
• package.json
• src/core/monitor.ts
• src/daemon/loop.ts
• src/observability/server.ts
• tests/observability/server.test.ts

📜 Review details

🔇 Additional comments (2)

package.json (1)

85-87: LGTM!

tests/observability/server.test.ts (1)

1-1: 🎯 Functional Correctness

No duplicate Vitest import is present.

tests/observability/server.test.ts has a single Vitest bindings import, so this comment does not apply.

			> Likely an incorrect or invalid review comment.

[AbdulmalikAlayande]

Thanks for flagging this, but closing without merging: npm audit --audit-level=high already reports zero vulnerabilities on current main (postcss resolved to 8.5.25 via vitest/vite, already past the vulnerable range) — the acceptance criteria this issue asks for are already satisfied, most likely as a side effect of other dependency work merged this wave since the issue was filed. Since the current resolution already exceeds the proposed override range (^8.5.18), adding it now would be a no-op. Closing #364 as already-resolved.