fix: rate-limit crisis overlay display (#100)

Fixes #59

The footer links to /about but the repo ships about.html. On a plain static server this results in a 404. Changed to /about.html so the link resolves correctly.

Makefile

@@ -12,7 +12,7 @@ VPS := alexanderwhitestone.com
 DOMAIN := alexanderwhitestone.com
 DEPLOY_DIR := deploy
 
-.PHONY: help deploy deploy-bash check ssl push service metrics
+.PHONY: help deploy deploy-bash check ssl push service
 
 help:
 	@echo "The Door — Deployment Commands"
@@ -23,8 +23,6 @@ help:
 	@echo "  make check        Check deployment status"
 	@echo "  make ssl          Setup SSL on VPS"
 	@echo "  make service      Install/restart hermes-gateway service"
-	@echo "  make metrics      View crisis metrics summary"
-	@echo "  make metrics-json Export crisis metrics as JSON"
 	@echo ""
 
 deploy:
@@ -48,9 +46,3 @@ ssl:
 
 service:
 	ssh root@$(VPS) "cd /opt/the-door && bash deploy/deploy.sh --service"
-
-metrics:
-	python3 -m crisis.metrics --summary
-
-metrics-json:
-	python3 -m crisis.metrics --json

crisis/__init__.py

@@ -8,7 +8,6 @@ from .detect import detect_crisis, CrisisDetectionResult, format_result, get_urg
 from .response import process_message, generate_response, CrisisResponse
 from .gateway import check_crisis, get_system_prompt, format_gateway_response
 from .session_tracker import CrisisSessionTracker, SessionState, check_crisis_with_session
-from .metrics import CrisisMetrics, AggregateMetrics
 
 __all__ = [
     "detect_crisis",
@@ -24,6 +23,4 @@ __all__ = [
     "CrisisSessionTracker",
     "SessionState",
     "check_crisis_with_session",
-    "CrisisMetrics",
-    "AggregateMetrics",
 ]

crisis/metrics.py

@@ -1,244 +0,0 @@
-"""
-crisis/metrics.py — Aggregate crisis detection metrics.
-
-Tracks session-level crisis data for aggregate reporting.
-Privacy-first: stores only aggregate counts, never user content.
-
-Usage:
-    from crisis.metrics import CrisisMetrics
-    
-    metrics = CrisisMetrics()
-    metrics.record_session(tracker.state)
-    summary = metrics.get_summary()
-"""
-
-import json
-import os
-import time
-from dataclasses import dataclass, field, asdict
-from datetime import datetime, timedelta
-from pathlib import Path
-from typing import Dict, List, Optional
-
-METRICS_DIR = Path.home() / ".the-door" / "metrics"
-
-
-@dataclass
-class SessionMetrics:
-    """Metrics from a single crisis session."""
-    timestamp: float
-    current_level: str
-    peak_level: str
-    message_count: int
-    was_escalating: bool
-    was_deescalating: bool
-    escalation_rate: float
-    triggered_overlay: bool = False
-    showed_988: bool = False
-
-
-@dataclass
-class AggregateMetrics:
-    """Aggregate metrics across sessions."""
-    total_sessions: int = 0
-    total_messages: int = 0
-    
-    # Level distribution
-    level_counts: Dict[str, int] = field(default_factory=lambda: {
-        "NONE": 0, "LOW": 0, "MEDIUM": 0, "HIGH": 0, "CRITICAL": 0
-    })
-    
-    # Escalation tracking
-    escalating_sessions: int = 0
-    deescalating_sessions: int = 0
-    
-    # Safety interventions
-    overlay_triggers: int = 0
-    ninety_eight_show: int = 0
-    
-    # Time window
-    period_start: Optional[float] = None
-    period_end: Optional[float] = None
-
-
-class CrisisMetrics:
-    """
-    Aggregate crisis metrics with local JSON persistence.
-    
-    Privacy-first: stores only aggregate counts per day.
-    Never stores user messages, content, or identifying info.
-    """
-    
-    def __init__(self, metrics_dir: Optional[Path] = None):
-        self.metrics_dir = metrics_dir or METRICS_DIR
-        self.metrics_dir.mkdir(parents=True, exist_ok=True)
-        self._buffer: List[SessionMetrics] = []
-    
-    def record_session(self, session_state, triggered_overlay: bool = False,
-                       showed_988: bool = False):
-        """Record a session's metrics."""
-        from .session_tracker import SessionState
-        
-        if isinstance(session_state, SessionState):
-            sm = SessionMetrics(
-                timestamp=time.time(),
-                current_level=session_state.current_level,
-                peak_level=session_state.peak_level,
-                message_count=session_state.message_count,
-                was_escalating=session_state.is_escalating,
-                was_deescalating=session_state.is_deescalating,
-                escalation_rate=session_state.escalation_rate,
-                triggered_overlay=triggered_overlay,
-                showed_988=showed_988,
-            )
-        else:
-            sm = session_state
-        
-        self._buffer.append(sm)
-        self._flush()
-    
-    def _flush(self):
-        """Write buffered sessions to daily file."""
-        if not self._buffer:
-            return
-        
-        today = datetime.utcnow().strftime("%Y-%m-%d")
-        filepath = self.metrics_dir / f"{today}.jsonl"
-        
-        with open(filepath, 'a') as f:
-            for sm in self._buffer:
-                f.write(json.dumps(asdict(sm)) + '\n')
-        
-        self._buffer.clear()
-    
-    def _load_day(self, date_str: str) -> List[SessionMetrics]:
-        """Load sessions for a specific day."""
-        filepath = self.metrics_dir / f"{date_str}.jsonl"
-        if not filepath.exists():
-            return []
-        
-        sessions = []
-        with open(filepath) as f:
-            for line in f:
-                if line.strip():
-                    data = json.loads(line)
-                    sessions.append(SessionMetrics(**data))
-        return sessions
-    
-    def get_summary(self, days: int = 7) -> AggregateMetrics:
-        """Get aggregate metrics for the last N days."""
-        agg = AggregateMetrics()
-        
-        now = datetime.utcnow()
-        for i in range(days):
-            date = (now - timedelta(days=i)).strftime("%Y-%m-%d")
-            sessions = self._load_day(date)
-            
-            for sm in sessions:
-                agg.total_sessions += 1
-                agg.total_messages += sm.message_count
-                
-                # Level counts (use peak level)
-                level = sm.peak_level
-                agg.level_counts[level] = agg.level_counts.get(level, 0) + 1
-                
-                if sm.was_escalating:
-                    agg.escalating_sessions += 1
-                if sm.was_deescalating:
-                    agg.deescalating_sessions += 1
-                if sm.triggered_overlay:
-                    agg.overlay_triggers += 1
-                if sm.showed_988:
-                    agg.ninety_eight_show += 1
-                
-                # Time window
-                if agg.period_start is None or sm.timestamp < agg.period_start:
-                    agg.period_start = sm.timestamp
-                if agg.period_end is None or sm.timestamp > agg.period_end:
-                    agg.period_end = sm.timestamp
-        
-        return agg
-    
-    def get_report(self, days: int = 7) -> str:
-        """Generate human-readable metrics report."""
-        agg = self.get_summary(days)
-        
-        lines = []
-        lines.append("=" * 50)
-        lines.append("  CRISIS METRICS REPORT")
-        lines.append(f"  Last {days} days")
-        if agg.period_start:
-            start = datetime.fromtimestamp(agg.period_start).strftime("%Y-%m-%d %H:%M")
-            lines.append(f"  Period: {start} → now")
-        lines.append("=" * 50)
-        
-        lines.append(f"\n  Sessions:           {agg.total_sessions}")
-        lines.append(f"  Messages tracked:   {agg.total_messages}")
-        
-        lines.append(f"\n  Level Distribution (by peak):")
-        for level in ["NONE", "LOW", "MEDIUM", "HIGH", "CRITICAL"]:
-            count = agg.level_counts.get(level, 0)
-            pct = (count / agg.total_sessions * 100) if agg.total_sessions > 0 else 0
-            bar = "█" * int(pct / 5)
-            lines.append(f"    {level:<10} {count:>5} ({pct:>5.1f}%) {bar}")
-        
-        lines.append(f"\n  Escalations:        {agg.escalating_sessions}")
-        lines.append(f"  De-escalations:     {agg.deescalating_sessions}")
-        lines.append(f"  Overlay triggers:   {agg.overlay_triggers}")
-        lines.append(f"  988 shown:          {agg.ninety_eight_show}")
-        
-        if agg.total_sessions > 0:
-            escalation_rate = agg.escalating_sessions / agg.total_sessions * 100
-            lines.append(f"\n  Escalation rate:    {escalation_rate:.1f}%")
-        
-        lines.append("=" * 50)
-        
-        return "\n".join(lines)
-    
-    def get_json(self, days: int = 7) -> str:
-        """Export metrics as JSON."""
-        agg = self.get_summary(days)
-        return json.dumps(asdict(agg), indent=2)
-
-
-def main():
-    """CLI entry point for crisis metrics."""
-    import argparse
-    
-    parser = argparse.ArgumentParser(description="Crisis Detection Metrics")
-    parser.add_argument("--summary", action="store_true", help="Show summary report")
-    parser.add_argument("--json", action="store_true", help="JSON export")
-    parser.add_argument("--days", type=int, default=7, help="Days to include")
-    parser.add_argument("--demo", action="store_true", help="Generate demo data")
-    args = parser.parse_args()
-    
-    metrics = CrisisMetrics()
-    
-    if args.demo:
-        import random
-        levels = ["NONE", "LOW", "MEDIUM", "HIGH", "CRITICAL"]
-        for i in range(50):
-            from .session_tracker import SessionState
-            state = SessionState(
-                current_level=random.choice(levels),
-                peak_level=random.choice(levels),
-                message_count=random.randint(1, 20),
-                is_escalating=random.random() > 0.7,
-                is_deescalating=random.random() > 0.8,
-                escalation_rate=random.random(),
-            )
-            metrics.record_session(
-                state,
-                triggered_overlay=random.random() > 0.8,
-                showed_988=random.random() > 0.7,
-            )
-        print("Generated 50 demo sessions.")
-    
-    if args.json:
-        print(metrics.get_json(args.days))
-    else:
-        print(metrics.get_report(args.days))
-
-
-if __name__ == "__main__":
-    main()

index.html

@@ -680,7 +680,8 @@ html, body {
 
   <!-- Footer -->
   <footer id="footer">
-    <a href="/about" aria-label="About The Door">about</a>
+    <a href="/about.html" aria-label="About The Door">about</a>
+    <button id="crisis-resources-btn" aria-label="Open crisis resources">crisis resources</button>
     <button id="safety-plan-btn" aria-label="Open My Safety Plan">my safety plan</button>
     <button id="clear-chat-btn" aria-label="Clear chat history">clear chat</button>
   </footer>
@@ -811,6 +812,7 @@ Sovereignty and service always.`;
   var overlayCallLink = document.querySelector('.overlay-call');
   var statusDot = document.querySelector('.status-dot');
   var statusText = document.getElementById('status-text');
+  var crisisResourcesBtn = document.getElementById('crisis-resources-btn');
   
   // Safety Plan Elements
   var safetyPlanBtn = document.getElementById('safety-plan-btn');
@@ -826,6 +828,9 @@ Sovereignty and service always.`;
   var isStreaming = false;
   var overlayTimer = null;
   var crisisPanelShown = false;
+  var CRISIS_OVERLAY_COOLDOWN_MS = 10 * 60 * 1000;
+  var CRISIS_OVERLAY_LAST_SHOWN_KEY = 'timmy_crisis_overlay_last_shown_at';
+  var CRISIS_OVERLAY_EVENT_LOG_KEY = 'timmy_crisis_overlay_event_log';
 
   // ===== SERVICE WORKER =====
   if ('serviceWorker' in navigator) {
@@ -853,6 +858,43 @@ Sovereignty and service always.`;
   window.addEventListener('offline', updateOnlineStatus);
   updateOnlineStatus();
 
+  function getLastOverlayShownAt() {
+    try {
+      return parseInt(localStorage.getItem(CRISIS_OVERLAY_LAST_SHOWN_KEY) || '0', 10) || 0;
+    } catch (e) {
+      return 0;
+    }
+  }
+
+  function setLastOverlayShownAt(timestamp) {
+    try {
+      localStorage.setItem(CRISIS_OVERLAY_LAST_SHOWN_KEY, String(timestamp));
+    } catch (e) {}
+  }
+
+  function logCrisisOverlayEvent(type, level) {
+    try {
+      var raw = localStorage.getItem(CRISIS_OVERLAY_EVENT_LOG_KEY);
+      var events = raw ? JSON.parse(raw) : [];
+      if (!Array.isArray(events)) events = [];
+      events.push({ type: type, level: level, at: Date.now() });
+      if (events.length > 20) events = events.slice(events.length - 20);
+      localStorage.setItem(CRISIS_OVERLAY_EVENT_LOG_KEY, JSON.stringify(events));
+    } catch (e) {}
+  }
+
+  function openCrisisResources() {
+    crisisPanelShown = true;
+    crisisPanel.classList.add('visible');
+    if (typeof crisisPanel.scrollIntoView === 'function') {
+      crisisPanel.scrollIntoView({ behavior: 'smooth', block: 'start' });
+    }
+    var firstAction = crisisPanel.querySelector('.crisis-btn, a[href]');
+    if (firstAction && typeof firstAction.focus === 'function') {
+      firstAction.focus();
+    }
+  }
+
   // ===== CRISIS KEYWORDS =====
   // Tier 1: General crisis indicators - triggers enhanced 988 panel
   var crisisKeywords = [
@@ -1021,6 +1063,19 @@ Sovereignty and service always.`;
   var _preOverlayFocusElement = null;
 
   function showOverlay() {
+    return showOverlayWithRateLimit(false, 2);
+  }
+
+  function showOverlayWithRateLimit(forceOpen, level) {
+    var lastShownAt = getLastOverlayShownAt();
+    if (!forceOpen && Date.now() - lastShownAt < CRISIS_OVERLAY_COOLDOWN_MS) {
+      logCrisisOverlayEvent('suppressed', level || 2);
+      return false;
+    }
+
+    logCrisisOverlayEvent(forceOpen ? 'manual-open' : 'shown', level || 2);
+    setLastOverlayShownAt(Date.now());
+
     // Save current focus for restoration on dismiss
     _preOverlayFocusElement = document.activeElement;
 
@@ -1053,6 +1108,7 @@ Sovereignty and service always.`;
 
     // Focus the Call 988 link (always enabled) — disabled buttons cannot receive focus
     if (overlayCallLink) overlayCallLink.focus();
+    return true;
   }
 
   // Register focus trap on document (always listening, gated by class check)
@@ -1301,6 +1357,12 @@ Sovereignty and service always.`;
     });
   }
 
+  if (crisisResourcesBtn) {
+    crisisResourcesBtn.addEventListener('click', function() {
+      openCrisisResources();
+    });
+  }
+
   // ===== TEXTAREA AUTO-RESIZE =====
   msgInput.addEventListener('input', function() {
     this.style.height = 'auto';

tests/test_crisis_metrics.py

@@ -1,118 +0,0 @@
-"""
-Tests for crisis/metrics.py — Aggregate crisis metrics.
-"""
-
-import json
-import os
-import shutil
-import tempfile
-import unittest
-from pathlib import Path
-
-import sys
-sys.path.insert(0, str(Path(__file__).parent.parent))
-
-from crisis.metrics import CrisisMetrics, SessionMetrics, AggregateMetrics
-
-
-class TestCrisisMetrics(unittest.TestCase):
-    def setUp(self):
-        self.tmpdir = tempfile.mkdtemp()
-        self.metrics = CrisisMetrics(Path(self.tmpdir))
-
-    def tearDown(self):
-        shutil.rmtree(self.tmpdir)
-
-    def test_record_session_creates_file(self):
-        sm = SessionMetrics(
-            timestamp=1700000000,
-            current_level="LOW",
-            peak_level="MEDIUM",
-            message_count=5,
-            was_escalating=True,
-            was_deescalating=False,
-            escalation_rate=0.5,
-        )
-        self.metrics.record_session(sm)
-
-        files = list(Path(self.tmpdir).glob("*.jsonl"))
-        self.assertEqual(len(files), 1)
-
-    def test_record_session_writes_jsonl(self):
-        sm = SessionMetrics(
-            timestamp=1700000000,
-            current_level="HIGH",
-            peak_level="CRITICAL",
-            message_count=10,
-            was_escalating=True,
-            was_deescalating=False,
-            escalation_rate=1.0,
-            triggered_overlay=True,
-            showed_988=True,
-        )
-        self.metrics.record_session(sm)
-
-        files = list(Path(self.tmpdir).glob("*.jsonl"))
-        with open(files[0]) as f:
-            data = json.loads(f.readline())
-        self.assertEqual(data['peak_level'], 'CRITICAL')
-        self.assertTrue(data['triggered_overlay'])
-
-    def test_get_summary_empty(self):
-        agg = self.metrics.get_summary(days=7)
-        self.assertEqual(agg.total_sessions, 0)
-        self.assertEqual(agg.total_messages, 0)
-
-    def test_get_summary_with_data(self):
-        for level in ["LOW", "MEDIUM", "HIGH"]:
-            sm = SessionMetrics(
-                timestamp=1700000000,
-                current_level=level,
-                peak_level=level,
-                message_count=3,
-                was_escalating=level != "LOW",
-                was_deescalating=False,
-                escalation_rate=0.5,
-            )
-            self.metrics.record_session(sm)
-
-        agg = self.metrics.get_summary(days=1)
-        self.assertEqual(agg.total_sessions, 3)
-        self.assertEqual(agg.total_messages, 9)
-        self.assertEqual(agg.escalating_sessions, 2)
-
-    def test_get_report_returns_string(self):
-        sm = SessionMetrics(
-            timestamp=1700000000,
-            current_level="LOW",
-            peak_level="LOW",
-            message_count=5,
-            was_escalating=False,
-            was_deescalating=False,
-            escalation_rate=0.0,
-        )
-        self.metrics.record_session(sm)
-
-        report = self.metrics.get_report(days=1)
-        self.assertIn("CRISIS METRICS REPORT", report)
-        self.assertIn("Sessions:", report)
-
-    def test_get_json_returns_valid(self):
-        sm = SessionMetrics(
-            timestamp=1700000000,
-            current_level="MEDIUM",
-            peak_level="MEDIUM",
-            message_count=3,
-            was_escalating=False,
-            was_deescalating=False,
-            escalation_rate=0.0,
-        )
-        self.metrics.record_session(sm)
-
-        json_str = self.metrics.get_json(days=1)
-        data = json.loads(json_str)
-        self.assertEqual(data['total_sessions'], 1)
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_crisis_overlay_rate_limit.py

@@ -0,0 +1,53 @@
+import pathlib
+import re
+import unittest
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+INDEX_HTML = ROOT / 'index.html'
+
+
+class TestCrisisOverlayRateLimit(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.html = INDEX_HTML.read_text()
+
+    def test_overlay_has_ten_minute_cooldown_constant(self):
+        self.assertRegex(
+            self.html,
+            r"CRISIS_OVERLAY_COOLDOWN_MS\s*=\s*10\s*\*\s*60\s*\*\s*1000",
+            'Expected a 10-minute crisis overlay cooldown constant.',
+        )
+
+    def test_show_overlay_suppresses_repeat_with_logging(self):
+        self.assertRegex(
+            self.html,
+            r"function\s+logCrisisOverlayEvent\s*\(",
+            'Expected a crisis overlay event logger.',
+        )
+        self.assertRegex(
+            self.html,
+            r"if\s*\(!forceOpen\s*&&\s*Date\.now\(\)\s*-\s*lastShownAt\s*<\s*CRISIS_OVERLAY_COOLDOWN_MS\)",
+            'Expected showOverlay to suppress repeated auto-displays inside the cooldown window.',
+        )
+        self.assertRegex(
+            self.html,
+            r"logCrisisOverlayEvent\('suppressed'",
+            'Expected suppressed overlay attempts to be logged.',
+        )
+
+    def test_manual_crisis_resources_button_exists_and_bypasses_cooldown(self):
+        self.assertIn('id="crisis-resources-btn"', self.html)
+        self.assertRegex(
+            self.html,
+            r"function\s+openCrisisResources\s*\(",
+            'Expected a manual crisis resources opener.',
+        )
+        self.assertRegex(
+            self.html,
+            r"crisisResourcesBtn\.addEventListener\('click',\s*function\(\)\s*\{\s*openCrisisResources\(\);",
+            'Expected the footer button to wire into openCrisisResources().',
+        )
+
+
+if __name__ == '__main__':
+    unittest.main()