[erikdarlingdata]

Darling gains an optional, read-only web dashboard so an operator can watch the fleet from any browser — a remote Mac included — without installing the WPF viewer. This is phase 1 (Erik-approved "yes to the web with defaults"): a fleet page, per-server drill-down, and fleet-wide alert history, all served by the Darling service. Built as a sequential three-builder train on this branch.

Closes #1562.

What ships

Hosting (Builder 1)

• A second, independent Kestrel host (DarlingWebHostService : BackgroundService) on its own port (default 5153), deliberately separate from the MCP host: MCP owns root on 5152, and the two need independent kill switches (web must not require mcp_enabled) and gate different blast radii (the MCP token guards analyze_server's live outbound SQL connections; the web surface is read-only over the store).
• Live toggle with no service restart: a web_enabled / web_port control-plane pair (the twin of MCP's), added by store migration V30. The viewer's Settings writes it, the worker publishes it via WebRuntimeState, and the supervisor (5s poll, DecideWebAction table, 30s failed-start backoff) starts / stops / rebinds the host within seconds. Until the first publish, the darling.json file values seed it.
• Shared bind/auth helpers extracted to Hosting/DarlingHostBinding (the ResolveBind reason ladder, in-app CIDR check, loopback-listener guard, constant-time token compare, firewall reconcile); the MCP host was refactored onto it and its existing tests stayed green (the anti-drift proof).
• Network exposure (managed mode): loopback is tokenless (Erik-ratified — the surface is read-only), LAN exposure rides a ?token= -> HMAC-signed HttpOnly SameSite=Strict session-cookie handshake behind an in-app CIDR gate, out-of-CIDR is 403, fail-closed. Content/web root pinned to AppContext.BaseDirectory (the Windows-service-CWD-is-System32 static-file footgun). No new packages.

Data / API (Builder 2)

• GET /api/read/{tool} — 69 endpoints, 1:1 with the read-only MCP tool catalog, calling the SAME public static tool methods the MCP server exposes so there is zero SQL / projection drift. An explicit dispatch table binds query-string params to each tool; a reflection test pins the endpoint set == the catalog MINUS exactly the six documented exclusions (analyze_server, mute_analysis_finding, and the analyze_*_plan compute family).
• Response mapping: a leading {/[ passes through as application/json (200); an "Error during ..." string maps to 500; any other bare string (validation / resolution) maps to 400 — both wrapped as {"error": ...}. The {status, message[, hints]} empty envelope passes through.
• GET /api/fleet — a pre-banded per-server card set + cross-server rollup from a new service-side DarlingFleetReader that runs a bounded set of cross-server aggregates (a fixed ~9 round-trips regardless of fleet size, not the WPF viewer's N-servers x per-metric fan-out), plus a matching get_fleet_overview MCP tool on the same reader.
• Banding unified ONCE in PerformanceMonitor.Common (ServerHealthClassifier + ServerHealthThresholds): collection freshness, the six per-metric bands, and the fleet band / worst-first score. The WPF viewer's ServerSummaryItem / FleetRollup now delegate to it, so thresholds that used to live twice can no longer drift (the viewer keeps its own brushes).

Frontend (Builder 3)

• Vanilla ES modules, no framework, no build step, and zero off-origin references (air-gapped). Theme tokens are the exact values lifted from the WPF DarkTheme.xaml (dark-only in phase 1).
• Fleet Overview (/api/fleet): a rollup summary, a worst-first "Needs attention" list (or an all-healthy line), and a card per server with a status dot, six per-metric health bands, and its last-collection time — the amber "Awaiting first collection" state rendered EXACTLY as the API reports it (the browser only renders; it never re-computes a threshold).
• Per-server drill-down: Overview stats, Wait Stats + a trend for the heaviest wait, Active Queries, a 4-series CPU chart, Memory and File-I/O trends, and Collection Health — all charted with dependency-free inline SVG (multi-series, CSS-var theming, mousemove tooltip).
• Alert History: fleet-wide, with a client-side server filter box.
• A hash router (#/fleet, #/server/{name}, #/alerts), a sidebar server list with band dots, and a 60s refresh loop that pauses while the tab is hidden.
• Discipline: all untrusted text (query text, object / wait / server names) renders through textContent (never innerHTML), and every naive-UTC timestamp is localized in the browser. Everything renders through a renderPanel({read, params, viz, span}) seam (viz registry: table / line / stat / bandlist; pages are hardcoded descriptor arrays) so Darling: custom views/notebooks (Datadog-style composition) on the web surface #1563 can later drive the pages from stored JSON — none of Darling: custom views/notebooks (Datadog-style composition) on the web surface #1563 is built here.

Migration

• V30 — config_service.web_enabled (default FALSE) + web_port (default 5153). Additive, schema-qualified config.* ALTERs with IF NOT EXISTS; the self-bump trigger covers the new columns and the table's grants are not column-carved, so no grant change is needed. (V29, taken by the long-query-completions collector after the dev rebase, is now documented alongside it in the store-schema table.)

Testing

• Full dotnet test Darling/Darling.Tests/Darling.Tests.csproj -c Release (no filter): 2375 passed, 0 failed, 137 skipped (the gated live-Postgres suite). The service builds clean in Release (0 errors).
• New frontend tests: an air-gap self-containment scan that walks wwwroot and fails CI, naming the file + line, on any absolute http(s):// or a protocol-relative //host in a fetchable context (the SVG XML namespace is the lone allowlisted literal), plus a pure line-classifier theory; the assets test was extended to pin the CSS/JS entry files in the build output. All 7 JS modules also pass node --check.

Not in phase 1 (by design)

Zero write paths and zero live-monitored-server hits (analyze_server and actual-plan re-run are explicitly out). The WPF viewer's Plan Viewer / FinOps / Recommendations / Index / deep Blocking / System Events / Config tabs are deferred. No TLS on this surface (the same reverse-proxy story as MCP). The live render is validated by the orchestrator on DARLING01; no browser was opened here.

🤖 Generated with Claude Code