Merge pull request 'Remove fabricated fallback work items' (#106) from timmy/105-do-not-display-fabricated-work-items into main

Remove fabricated fallback work items (#106)

frontend/index.html

@@ -2,7 +2,7 @@
 <html lang="en">
 <head>
 <meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
 <title>Stackchain Dashboard</title>
 <style>
 :root { color-scheme: dark; --bg:#050c15; --panel:#0b1526; --line:#1b2d45; --text:#e5e7eb; --accent:#60a5fa; }
@@ -161,6 +161,7 @@ textarea { resize: vertical; min-height: 120px; }
 
 <script src="static/markdown.js"></script>
 <script src="static/commands.js"></script>
+<script src="static/widgets.js"></script>
 <script>
 (function(){
   const qs = (s, el=document) => el.querySelector(s);
@@ -216,29 +217,17 @@ textarea { resize: vertical; min-height: 120px; }
         '<div class="muted">' + escapeHtml(p.state) + ' by ' + escapeHtml(String(p.user || '')) + '</div></div>').join('') : '<div class="muted">No PRs.</div>');
 
       paintDeltas(data.deltas || []);
-      setStatus('Live · updated just now');
+      setStatus(data.error ? 'Degraded · ' + data.error : 'Live · updated just now');
       setClock();
     } catch (e) {
       console.error('context failed', e);
       liveMode = false;
-      setStatus('Mock');
-      qs('#context').innerHTML = '<div class="kv"><div class="label">User</div><div class="value">Timmy Jr</div><div class="label">Repos</div><div class="value">3</div><div class="label">Issues</div><div class="value">—</div><div class="label">PRs</div><div class="value">—</div></div>';
-      qs('#view-hint').textContent = 'Active view: dashboard';
-      const mockIssues = [
-        { number: 1, title: 'Kickoff issue', state: 'open', labels: ['epic'], url: '#1' },
-        { number: 8, title: 'Live UI implementation', state: 'open', labels: ['frontend'], url: '#8' },
-        { number: 37, title: 'Docker build and push', state: 'open', labels: ['devops'], url: '#37' },
-      ];
-      qs('#issues-content').innerHTML = mockIssues.map(i => '<div style="margin:6px 0;"><a href="' + escAttr(i.url) + '">#' + i.number + ' ' + escapeHtml(i.title) + '</a><div class="muted">' + (i.labels||[]).map(l=>'<span class="pill">'+escapeHtml(String(l))+'</span>').join(' ') + '</div></div>').join('');
-      const mockPrs = [
-        { number: 4, title: 'Agent UI delta binding', state: 'open', user: 'turdbot', url: '#4' },
-      ];
-      qs('#prs-content').innerHTML = mockPrs.map(p => '<div style="margin:6px 0;"><a href="' + escAttr(p.url) + '">#' + p.number + ' ' + escapeHtml(p.title) + '</a><div class="muted">' + escapeHtml(p.state) + ' by ' + escapeHtml(String(p.user||'')) + '</div></div>').join('');
-      paintDeltas([
-        {panel:'triage', action:'open', target:'#1', priority:'high'},
-        {panel:'review', action:'review', target:'#4', priority:'medium'},
-        {panel:'layout', action:'highlight', target:'issues', priority:'low'},
-      ]);
+      setStatus('Unavailable');
+      qs('#context').innerHTML = '<div class="muted">Context unavailable.</div>';
+      qs('#view-hint').textContent = 'Active view unavailable.';
+      qs('#issues-content').innerHTML = '<div class="muted">Work items unavailable.</div>';
+      qs('#prs-content').innerHTML = '<div class="muted">Work items unavailable.</div>';
+      paintDeltas([]);
     }
   }
 
@@ -361,20 +350,7 @@ textarea { resize: vertical; min-height: 120px; }
   tickWidgets();
 
   /* Widgets */
-  async function updateRepoMix() {
-    const el = qs('#repo-mix');
-    try {
-      const res = await fetch('api/v1/context', { headers: { Accept: 'application/json' } });
-      const data = await res.json();
-      const repos = data.repos || [];
-      const issues = (data.issues||[]).filter(i=>i.state==='open');
-      const prs = data.pull_requests || [];
-      el.innerHTML = '<div class="kv"><div class="label">Repos</div><div class="value">' + repos.length + '</div><div class="label">Open issues</div><div class="value">' + issues.length + '</div><div class="label">Open PRs</div><div class="value">' + prs.length + '</div></div>';
-    } catch (e) {
-      el.innerHTML = '<div class="muted">Widget unavailable.</div>';
-    }
-  }
-  updateRepoMix();
+  updateRepoMix(qs('#repo-mix'), fetch);
 
   function widgetTick() { const el=qs('#widget-clock'); if(el) el.textContent = fmt(new Date()); }
   setInterval(widgetTick, 1000);

frontend/widgets.js

@@ -0,0 +1,19 @@
+async function updateRepoMix(element, fetchContext = fetch) {
+  try {
+    const response = await fetchContext('api/v1/context', {
+      headers: { Accept: 'application/json' },
+    });
+    if (!response.ok) throw new Error('HTTP ' + response.status);
+    const data = await response.json();
+    const repos = data.repos || [];
+    const issues = (data.issues || []).filter((issue) => issue.state === 'open');
+    const pullRequests = data.pull_requests || [];
+    element.innerHTML = '<div class="kv"><div class="label">Repos</div><div class="value">' + repos.length + '</div><div class="label">Open issues</div><div class="value">' + issues.length + '</div><div class="label">Open PRs</div><div class="value">' + pullRequests.length + '</div></div>';
+  } catch (error) {
+    element.innerHTML = '<div class="muted">Widget unavailable.</div>';
+  }
+}
+
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = updateRepoMix;
+}

src/gitea_proxy.py

@@ -42,10 +42,27 @@ async def activity_events() -> list[dict]:
     events = await fetch(f"users/{user['login']}/activities/feeds?limit=20")
     return [
         {
-            "type": event.get("op_type", "activity"),
-            "actor": event.get("act_user") or {},
-            "repo": event.get("repo") or {},
-            "created_at": event.get("created", ""),
+            "type": (
+                event.get("op_type")
+                if isinstance(event.get("op_type"), str) and event.get("op_type")
+                else "activity"
+            ),
+            "actor": (
+                event.get("act_user")
+                if isinstance(event.get("act_user"), dict)
+                else {}
+            ),
+            "repo": (
+                event.get("repo")
+                if isinstance(event.get("repo"), dict)
+                else {}
+            ),
+            "created_at": (
+                event.get("created")
+                if isinstance(event.get("created"), str)
+                else ""
+            ),
         }
-        for event in events
+        for event in (events or [])
+        if isinstance(event, dict)
     ]

src/main.py

@@ -43,6 +43,8 @@ async def readiness():
         user = await asyncio.wait_for(
             current_user(), timeout=READINESS_TIMEOUT_SECONDS
         )
+        if not isinstance(user, dict) or not user.get("login"):
+            raise ValueError("Gitea current-user response did not include a login")
     except Exception as exc:
         timed_out = isinstance(exc, TimeoutError)
         error_message = (
@@ -75,6 +77,15 @@ async def context() -> JSONResponse:
             asyncio.gather(current_user(), repos(), issues(), pull_requests()),
             timeout=CONTEXT_TIMEOUT_SECONDS,
         )
+        if not isinstance(user_data, dict):
+            raise ValueError("Gitea current-user response was not an object")
+        if not all(field in user_data for field in ("id", "login")):
+            raise ValueError("Gitea current-user response did not include id and login")
+        if any(
+            data is not None and not isinstance(data, list)
+            for data in (repo_data, issues_data, prs_data)
+        ):
+            raise ValueError("Gitea collection response was not a list")
     except Exception as e:
         error_message = (
             f"Gitea context request timed out after {CONTEXT_TIMEOUT_SECONDS:g}s"
@@ -100,16 +111,52 @@ async def context() -> JSONResponse:
         Repo(id=r["id"], name=r["name"], full_name=r["full_name"], description=r.get("description") or "", url=r["html_url"], updated_at=r.get("updated_at", ""))
         for r in (repo_data or [])[:50]
         if isinstance(r, dict)
+        and all(field in r for field in ("id", "name", "full_name", "html_url"))
     ]
     issue_models = [
-        Issue(id=i["id"], number=i["number"], title=i["title"], state=i["state"], labels=[l.get("name", "") for l in (i.get("labels") or [])], assignees=[a.get("login", "") for a in (i.get("assignees") or [])], url=i["html_url"])
+        Issue(
+            id=i["id"],
+            number=i["number"],
+            title=i["title"],
+            state=i["state"],
+            labels=[
+                label.get("name", "")
+                for label in (i.get("labels") or [])
+                if isinstance(label, dict)
+            ],
+            assignees=[
+                assignee.get("login", "")
+                for assignee in (i.get("assignees") or [])
+                if isinstance(assignee, dict)
+            ],
+            url=i["html_url"],
+        )
         for i in (issues_data or [])[:50]
         if isinstance(i, dict)
+        and all(
+            field in i
+            for field in ("id", "number", "title", "state", "html_url")
+        )
     ]
     pr_models = [
-        PullRequest(id=p["id"], number=p["number"], title=p["title"], state=p["state"], user=(p.get("user") or {}).get("login", ""), url=p["html_url"])
+        PullRequest(
+            id=p["id"],
+            number=p["number"],
+            title=p["title"],
+            state=p["state"],
+            user=(
+                p["user"].get("login", "")
+                if isinstance(p.get("user"), dict)
+                else ""
+            ),
+            url=p["html_url"],
+        )
         for p in (prs_data or [])[:50]
         if isinstance(p, dict)
+        and all(
+            field in p
+            for field in ("id", "number", "title", "state", "html_url")
+        )
     ]
     ctx = compute(user_model, repo_models, issue_models, pr_models)
     return JSONResponse(ctx.model_dump())

tests/test_context_timeout.py

@@ -65,6 +65,37 @@ async def test_context_normalizes_nullable_issue_collections(monkeypatch):
     assert issue["assignees"] == []
 
 
+@pytest.mark.anyio
+async def test_context_skips_malformed_nested_issue_metadata(monkeypatch):
+    async def user():
+        return {"id": 1, "login": "timmy"}
+
+    async def empty_collection():
+        return []
+
+    async def issue_collection():
+        return [{
+            "id": 85,
+            "number": 85,
+            "title": "Malformed nested metadata",
+            "state": "open",
+            "labels": [None, {"name": "bug"}, "invalid"],
+            "assignees": [None, {"login": "timmy"}, "invalid"],
+            "html_url": "https://forge.example/issues/85",
+        }]
+
+    monkeypatch.setattr(main, "current_user", user)
+    monkeypatch.setattr(main, "repos", empty_collection)
+    monkeypatch.setattr(main, "issues", issue_collection)
+    monkeypatch.setattr(main, "pull_requests", empty_collection)
+
+    response = await main.context()
+    issue = json.loads(response.body)["issues"][0]
+
+    assert issue["labels"] == ["bug"]
+    assert issue["assignees"] == ["timmy"]
+
+
 @pytest.mark.anyio
 async def test_context_normalizes_nullable_repository_description(monkeypatch):
     async def user():
@@ -122,6 +153,35 @@ async def test_context_normalizes_nullable_pull_request_author(monkeypatch):
     assert pull_request["user"] == ""
 
 
+@pytest.mark.anyio
+async def test_context_normalizes_malformed_pull_request_author(monkeypatch):
+    async def user():
+        return {"id": 1, "login": "timmy"}
+
+    async def empty_collection():
+        return []
+
+    async def pull_request_collection():
+        return [{
+            "id": 87,
+            "number": 87,
+            "title": "Malformed author",
+            "state": "open",
+            "user": "unknown",
+            "html_url": "https://forge.example/pulls/87",
+        }]
+
+    monkeypatch.setattr(main, "current_user", user)
+    monkeypatch.setattr(main, "repos", empty_collection)
+    monkeypatch.setattr(main, "issues", empty_collection)
+    monkeypatch.setattr(main, "pull_requests", pull_request_collection)
+
+    response = await main.context()
+    pull_request = json.loads(response.body)["pull_requests"][0]
+
+    assert pull_request["user"] == ""
+
+
 @pytest.mark.anyio
 async def test_context_normalizes_null_collection_payloads(monkeypatch):
     async def user():
@@ -143,6 +203,29 @@ async def test_context_normalizes_null_collection_payloads(monkeypatch):
     assert context["pull_requests"] == []
 
 
+@pytest.mark.anyio
+async def test_context_returns_fallback_for_malformed_collection_payloads(monkeypatch):
+    async def user():
+        return {"id": 1, "login": "timmy"}
+
+    async def malformed_collection():
+        return {"message": "unexpected upstream shape"}
+
+    monkeypatch.setattr(main, "current_user", user)
+    monkeypatch.setattr(main, "repos", malformed_collection)
+    monkeypatch.setattr(main, "issues", malformed_collection)
+    monkeypatch.setattr(main, "pull_requests", malformed_collection)
+
+    response = await main.context()
+    context = json.loads(response.body)
+
+    assert response.status_code == 200
+    assert context["repos"] == []
+    assert context["issues"] == []
+    assert context["pull_requests"] == []
+    assert context["error"] == "Gitea collection response was not a list"
+
+
 @pytest.mark.anyio
 async def test_context_normalizes_nullable_user_profile_fields(monkeypatch):
     async def user():
@@ -167,3 +250,140 @@ async def test_context_normalizes_nullable_user_profile_fields(monkeypatch):
     assert response.status_code == 200
     assert context["user"]["full_name"] == ""
     assert context["user"]["email"] == ""
+
+
+@pytest.mark.anyio
+async def test_context_returns_fallback_for_null_current_user_payload(monkeypatch):
+    async def null_user():
+        return None
+
+    async def empty_collection():
+        return []
+
+    monkeypatch.setattr(main, "current_user", null_user)
+    monkeypatch.setattr(main, "repos", empty_collection)
+    monkeypatch.setattr(main, "issues", empty_collection)
+    monkeypatch.setattr(main, "pull_requests", empty_collection)
+
+    response = await main.context()
+    context = json.loads(response.body)
+
+    assert response.status_code == 200
+    assert context["repos"] == []
+    assert context["error"] == "Gitea current-user response was not an object"
+
+
+@pytest.mark.anyio
+async def test_context_returns_fallback_for_incomplete_current_user_payload(monkeypatch):
+    async def incomplete_user():
+        return {"id": 1}
+
+    async def empty_collection():
+        return []
+
+    monkeypatch.setattr(main, "current_user", incomplete_user)
+    monkeypatch.setattr(main, "repos", empty_collection)
+    monkeypatch.setattr(main, "issues", empty_collection)
+    monkeypatch.setattr(main, "pull_requests", empty_collection)
+
+    response = await main.context()
+    context = json.loads(response.body)
+
+    assert response.status_code == 200
+    assert context["repos"] == []
+    assert context["error"] == "Gitea current-user response did not include id and login"
+
+
+@pytest.mark.anyio
+async def test_context_skips_malformed_repository_entries(monkeypatch):
+    async def user():
+        return {"id": 1, "login": "timmy"}
+
+    async def repository_collection():
+        return [
+            {"id": 79, "name": "missing-required-fields"},
+            {
+                "id": 1,
+                "name": "dashboard",
+                "full_name": "stackchain/dashboard",
+                "description": "Operations dashboard",
+                "html_url": "https://forge.example/stackchain/dashboard",
+            },
+        ]
+
+    async def empty_collection():
+        return []
+
+    monkeypatch.setattr(main, "current_user", user)
+    monkeypatch.setattr(main, "repos", repository_collection)
+    monkeypatch.setattr(main, "issues", empty_collection)
+    monkeypatch.setattr(main, "pull_requests", empty_collection)
+
+    response = await main.context()
+    repositories = json.loads(response.body)["repos"]
+
+    assert [repository["name"] for repository in repositories] == ["dashboard"]
+
+
+@pytest.mark.anyio
+async def test_context_skips_malformed_issue_entries(monkeypatch):
+    async def user():
+        return {"id": 1, "login": "timmy"}
+
+    async def issue_collection():
+        return [
+            {"id": 81, "title": "missing-required-fields"},
+            {
+                "id": 1,
+                "number": 81,
+                "title": "Valid issue",
+                "state": "open",
+                "html_url": "https://forge.example/stackchain/dashboard/issues/81",
+            },
+        ]
+
+    async def empty_collection():
+        return []
+
+    monkeypatch.setattr(main, "current_user", user)
+    monkeypatch.setattr(main, "repos", empty_collection)
+    monkeypatch.setattr(main, "issues", issue_collection)
+    monkeypatch.setattr(main, "pull_requests", empty_collection)
+
+    response = await main.context()
+    issues = json.loads(response.body)["issues"]
+
+    assert [issue["title"] for issue in issues] == ["Valid issue"]
+
+
+@pytest.mark.anyio
+async def test_context_skips_malformed_pull_request_entries(monkeypatch):
+    async def user():
+        return {"id": 1, "login": "timmy"}
+
+    async def pull_request_collection():
+        return [
+            {"id": 83, "title": "missing-required-fields"},
+            {
+                "id": 1,
+                "number": 83,
+                "title": "Valid pull request",
+                "state": "open",
+                "html_url": "https://forge.example/stackchain/stackchain-dashboard/pulls/83",
+            },
+        ]
+
+    async def empty_collection():
+        return []
+
+    monkeypatch.setattr(main, "current_user", user)
+    monkeypatch.setattr(main, "repos", empty_collection)
+    monkeypatch.setattr(main, "issues", empty_collection)
+    monkeypatch.setattr(main, "pull_requests", pull_request_collection)
+
+    response = await main.context()
+    pull_requests = json.loads(response.body)["pull_requests"]
+
+    assert [pull_request["title"] for pull_request in pull_requests] == [
+        "Valid pull request"
+    ]

tests/test_event_stream.py

@@ -118,3 +118,71 @@ async def test_activity_events_fetches_feed_for_authenticated_user(monkeypatch):
         "created_at": "2026-08-05T03:00:00Z",
     }]
     assert paths == ["users/timmy/activities/feeds?limit=20"]
+
+
+@pytest.mark.anyio
+async def test_activity_events_skips_malformed_feed_entries(monkeypatch):
+    async def fake_current_user():
+        return {"login": "timmy"}
+
+    async def fake_fetch(path):
+        return [
+            None,
+            {
+                "op_type": "push",
+                "act_user": {"login": "timmy"},
+                "repo": {"full_name": "stackchain/stackchain-dashboard"},
+                "created": "2026-08-06T08:00:00Z",
+            },
+            "invalid",
+        ]
+
+    monkeypatch.setattr(gitea_proxy, "current_user", fake_current_user)
+    monkeypatch.setattr(gitea_proxy, "fetch", fake_fetch)
+
+    result = await gitea_proxy.activity_events()
+
+    assert result == [{
+        "type": "push",
+        "actor": {"login": "timmy"},
+        "repo": {"full_name": "stackchain/stackchain-dashboard"},
+        "created_at": "2026-08-06T08:00:00Z",
+    }]
+
+
+@pytest.mark.anyio
+async def test_activity_events_normalizes_null_feed_payload(monkeypatch):
+    async def fake_current_user():
+        return {"login": "timmy"}
+
+    async def fake_fetch(path):
+        return None
+
+    monkeypatch.setattr(gitea_proxy, "current_user", fake_current_user)
+    monkeypatch.setattr(gitea_proxy, "fetch", fake_fetch)
+
+    assert await gitea_proxy.activity_events() == []
+
+
+@pytest.mark.anyio
+async def test_activity_events_normalizes_malformed_nested_metadata(monkeypatch):
+    async def fake_current_user():
+        return {"login": "timmy"}
+
+    async def fake_fetch(path):
+        return [{
+            "op_type": None,
+            "act_user": "unknown",
+            "repo": None,
+            "created": None,
+        }]
+
+    monkeypatch.setattr(gitea_proxy, "current_user", fake_current_user)
+    monkeypatch.setattr(gitea_proxy, "fetch", fake_fetch)
+
+    assert await gitea_proxy.activity_events() == [{
+        "type": "activity",
+        "actor": {},
+        "repo": {},
+        "created_at": "",
+    }]

tests/test_health.py

@@ -42,6 +42,23 @@ async def test_readiness_endpoint_returns_503_when_gitea_is_unavailable(monkeypa
     assert b'"error":"connection refused"' in response.body
 
 
+@pytest.mark.anyio
+async def test_readiness_endpoint_returns_503_for_null_current_user_payload(monkeypatch):
+    async def null_user():
+        return None
+
+    monkeypatch.setattr(main, "current_user", null_user)
+
+    response = await main.readiness()
+
+    assert response.status_code == 503
+    assert json.loads(response.body) == {
+        "status": "not_ready",
+        "service": "stackchain-dashboard",
+        "error": "Gitea current-user response did not include a login",
+    }
+
+
 @pytest.mark.anyio
 async def test_readiness_endpoint_times_out_and_cancels_stalled_gitea_check(monkeypatch):
     cancelled = asyncio.Event()

tests/test_views.py

@@ -10,3 +10,12 @@ async def test_dashboard_renders_outside_repository_working_directory(monkeypatc
     html = await dashboard()
 
     assert "Stackchain Dashboard" in html
+
+
+@pytest.mark.anyio
+async def test_dashboard_viewport_allows_mobile_zoom():
+    html = await dashboard()
+
+    assert 'name="viewport"' in html
+    assert "width=device-width" in html
+    assert "user-scalable=no" not in html

tests/test_widgets.py

@@ -1,11 +1,58 @@
+import json
+import subprocess
+from pathlib import Path
+
 import pytest
 
 from src.views import dashboard
 
 
+WIDGETS = Path(__file__).parents[1] / "frontend" / "widgets.js"
+
+
 @pytest.mark.anyio
 async def test_dashboard_renders_repo_mix_placeholder_before_javascript_runs():
     html = await dashboard()
     server_rendered_html = html.split("<script>", 1)[0]
 
     assert '<div class="small" id="repo-mix">Loading…</div>' in server_rendered_html
+
+
+@pytest.mark.anyio
+async def test_dashboard_marks_fallback_context_as_degraded_instead_of_live():
+    html = await dashboard()
+
+    assert "data.error ? 'Degraded · ' + data.error : 'Live · updated just now'" in html
+
+
+@pytest.mark.anyio
+async def test_dashboard_does_not_offer_fabricated_work_when_context_fetch_fails():
+    html = await dashboard()
+
+    assert "Work items unavailable." in html
+    assert "Kickoff issue" not in html
+    assert "Live UI implementation" not in html
+    assert "Docker build and push" not in html
+    assert "Agent UI delta binding" not in html
+
+
+def test_repo_mix_reports_unavailable_for_failed_context_response():
+    script = f"""
+const updateRepoMix = require({json.dumps(str(WIDGETS))});
+const element = {{ innerHTML: 'stale counts' }};
+const failedFetch = async () => ({{
+  ok: false,
+  status: 503,
+  json: async () => ({{ error: 'upstream unavailable' }}),
+}});
+
+updateRepoMix(element, failedFetch).then(() => {{
+  if (!element.innerHTML.includes('Widget unavailable.')) {{
+    throw new Error(`expected unavailable state, got: ${{element.innerHTML}}`);
+  }}
+}});
+"""
+
+    subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )