Polish dashboard: e2e traffic, hash chain viz, race fix, screenshots

[ojongerius]

Summary

• E2e traffic generator (cmd/beacon-e2e/) — drives real MCP traffic through beacon-proxy wrapping the filesystem server, producing genuine audit trails with valid hash chains
• Rich hash chain visualization — per-message verification with sequence numbers, direction badges, truncated SHA-256 hashes, and linkage arrows
• Fix JSON tags on ChainStatus struct (broken_at/error were not serializing to JS correctly)
• Fix data race in TestSSEEndpoint — uses httptest.NewServer instead of raw ResponseRecorder
• make demo runs real e2e traffic; make demo-fake uses synthetic data
• README screenshots updated with tool calls and hash chain views
• Intent chain enhancements, multi-server config, verify CLI, dashboard auto-select

Test plan

• make test passes
• make test-race passes (race fix verified)
• make lint clean
• make demo generates real traffic with valid hash chain
• beacon-proxy verify confirms chain intact
• Dashboard hash chain tab shows per-message entries

🔦

[Copilot]

Pull request overview

This PR polishes the Beacon dashboard and demo workflow by adding real end-to-end MCP traffic generation, richer intent/hash-chain visualization, new API endpoints for intents and chain detail, and a CLI hash-chain verifier.

Changes:

• Add real e2e traffic generator (cmd/beacon-e2e) and update demo Makefile targets (make demo, make demo-fake).
• Expand dashboard UI for intent chains and detailed per-message hash chain verification, backed by new server/store endpoints.
• Add beacon-proxy verify CLI subcommand and update intent/query data returned to the dashboard.

Reviewed changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
internal/web/static/index.html	UI/JS updates for intent chains and detailed hash-chain visualization + auto-session selection.
internal/web/server.go	Adds /api/intents and /api/chain/detail endpoints.
internal/web/server_test.go	Fixes SSE test race by using httptest.NewServer.
internal/audit/store.go	Fixes ChainStatus JSON tags and adds VerifyChainDetail with per-message entries.
internal/audit/queries.go	Extends intent tool entry fields and allows listing intents across all sessions.
cmd/beacon-proxy/main.go	Adds verify subcommand to validate DB hash-chain integrity.
cmd/beacon-e2e/main.go	New tool that drives real MCP traffic through beacon-proxy.
cmd/beacon-traffic/main.go	Enhances fake traffic generator to emit multiple intent “bursts”.
configs/example_claude.json	Adds multi-server example configuration.
README.md	Documents verify, updates screenshots, and adds a quick demo section.
Makefile	Adds demo, demo-fake, and verify targets.

Comments suppressed due to low confidence (1)

internal/audit/queries.go:227

• ListIntents now supports sessionID == "" (all sessions) and returns additional fields (arguments, duration_ms, server_name), but TestListIntents still only asserts the tool name. Extend tests to validate the new fields and add a case for the empty-sessionID behavior to prevent regressions in the dashboard endpoints.

// ListIntents returns intent contexts with their tool calls for a session.
// If sessionID is empty, returns intents across all sessions.
func (s *Store) ListIntents(sessionID string) ([]IntentSummary, error) {
	query := `
		SELECT ic.id, ic.session_id, ic.created_at,
			   itc.sequence_order, itc.tool_call_id,
			   tc.tool_name, tc.arguments, tc.operation_type, tc.risk_score,
			   tc.policy_action, tc.duration_ms, se.server_name
		FROM intent_contexts ic
		JOIN intent_tool_calls itc ON itc.intent_id = ic.id
		JOIN tool_calls tc ON tc.id = itc.tool_call_id
		JOIN sessions se ON se.id = ic.session_id
	`
	var args []any
	if sessionID != "" {
		query += " WHERE ic.session_id = ?"
		args = append(args, sessionID)
	}
	query += " ORDER BY ic.created_at ASC, itc.sequence_order ASC"

	rows, err := s.db.Query(query, args...)
	if err != nil {
		return nil, err
	}
	defer rows.Close()

	intentMap := make(map[string]*IntentSummary)
	var order []string

	for rows.Next() {
		var intentID, sid string
		var createdAt time.Time
		var entry IntentToolEntry
		var durationMs sql.NullInt64
		if err := rows.Scan(&intentID, &sid, &createdAt,
			&entry.SequenceOrder, &entry.ToolCallID,
			&entry.ToolName, &entry.Arguments, &entry.OperationType,
			&entry.RiskScore, &entry.PolicyAction, &durationMs, &entry.ServerName); err != nil {
			return nil, err
		}
		if durationMs.Valid {
			entry.DurationMs = &durationMs.Int64
		}
		entry.Arguments = s.decrypt(entry.Arguments)
		if _, ok := intentMap[intentID]; !ok {
			intentMap[intentID] = &IntentSummary{
				ID:        intentID,
				SessionID: sid,
				CreatedAt: createdAt,
			}
			order = append(order, intentID)
		}
		intentMap[intentID].ToolCalls = append(intentMap[intentID].ToolCalls, entry)
	}

	var out []IntentSummary
	for _, id := range order {
		out = append(out, *intentMap[id])
	}
	return out, rows.Err()

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

riskStepClass has two consecutive branches returning 'step-risk-low' (<=10 and <=30), so the first condition is redundant and likely not the intended risk bucketing. Align these thresholds with riskBadgeClass (<=30 low, <=60 med, etc.) to avoid incorrect styling.

[ojongerius]

Fixed in e4633aa — removed the redundant <= 10 branch so the thresholds are now <= 30, <= 60, <= 80, else.

[Copilot]

VerifyChainDetail introduces new verification behavior (per-message entries and early-return semantics) but there are no unit tests covering it (including encryption and tamper cases). Add tests similar to the existing VerifyChain_* tests to ensure the returned entries and status stay consistent as the schema/crypto changes.

[ojongerius]

Good call — VerifyChainDetail is tested indirectly via the /api/chain/detail handler in integration tests, but dedicated unit tests would be better. Tracked for follow-up.

[Copilot]

New endpoints /api/intents and /api/chain/detail are introduced, but there are no handler tests covering them (unlike /api/chain/verify). Add tests in internal/web/server_test.go to assert status codes and JSON shapes so dashboard changes don’t silently break.

[ojongerius]

Fair point. The existing test suite covers the core handlers but these newer endpoints need their own tests. Tracked for follow-up.

[Copilot]

The placeholder GITHUB_TOKEN value starts with ghp_, which matches real GitHub token formats and can trigger secret scanners / be mistaken for a real credential. Use a clearly non-token placeholder (e.g. YOUR_GITHUB_TOKEN) to avoid false positives.

Suggested change

	"GITHUB_TOKEN": "ghp_your-token-here"
	"GITHUB_TOKEN": "YOUR_GITHUB_TOKEN"

[ojongerius]

Fixed in e4633aa — changed to YOUR_GITHUB_TOKEN and YOUR_SLACK_BOT_TOKEN to avoid triggering secret scanners.

[Copilot]

argsSummary is inserted into innerHTML without escaping. Since it is derived from tc.arguments (which can contain attacker-controlled strings), this is another XSS vector in the intents view. Escape the summary before interpolation (or build the DOM with textContent rather than innerHTML).

Suggested change

	<span class="step-args" title="${esc(tc.arguments)}">${argsSummary}</span>
	<span class="step-args" title="${esc(tc.arguments)}">${esc(argsSummary)}</span>

[ojongerius]

Fixed in e4633aa — argsSummary is now escaped via esc() before interpolation into innerHTML.

[Copilot]

demo-fake starts beacon-proxy with -- echo "beacon-demo-server", but echo exits immediately, so the proxy (and dashboard) will shut down right away. Use a long-running command (or a dedicated beacon-proxy serve mode) so the dashboard stays up for users to explore the generated data.

Suggested change

	@./$(BINARY) --server-name demo --port 8080 -- echo "beacon-demo-server"
	@./$(BINARY) --server-name demo --port 8080 -- sh -c 'echo "beacon-demo-server"; tail -f /dev/null'

[ojongerius]

Fixed in e4633aa — changed to sh -c 'echo "beacon-demo-server"; exec cat' so the process stays alive for the proxy.

[Copilot]

send ignores errors from json.Marshal and both stdin.Write calls. If the child process exits or the pipe breaks, the generator can silently keep going with missing traffic. Handle and propagate these write/marshal errors so failures are visible.

Suggested change

	data, _ := json.Marshal(req)
	stdin.Write(data)
	stdin.Write([]byte("\n"))
	mu.Unlock()
	defer mu.Unlock()
	data, err := json.Marshal(req)
	if err != nil {
	log.Printf("failed to marshal request: %v", err)
	return nil
	}
	if _, err := stdin.Write(data); err != nil {
	log.Printf("failed to write request to stdin: %v", err)
	return nil
	}
	if _, err := stdin.Write([]byte("\n")); err != nil {
	log.Printf("failed to write newline to stdin: %v", err)
	return nil
	}

[ojongerius]

Fixed in e4633aa — send() now checks errors from json.Marshal and both stdin.Write calls, logging and returning nil on failure.

[Copilot]

send returns the first JSON message with a non-null id, but it doesn’t verify that resp.ID matches the request being sent. If the server ever emits out-of-order responses (or responses to earlier requests), this can misattribute results and produce confusing demo output. Compare the response id to req.ID before returning.

[ojongerius]

Valid observation. In practice this is a single-threaded serial request flow so IDs always match in order, but adding ID matching would be more robust. Low priority for an e2e test harness.

[Copilot]

prevHash is computed but never used when rendering the chain link, which is dead code and makes the intent of this block unclear. Remove it or use it in the link text/title if it’s meant to show the previous entry’s hash.

Suggested change

const prevHash = entries[i-1].hash ? entries[i-1].hash.substring(0, 8) : '';

[ojongerius]

Fixed in e4633aa — removed the unused prevHash variable.

[Copilot]

narrative is interpolated into innerHTML without escaping. Since it can include tool_name values from the API, this allows HTML injection/XSS in the Intent label. Escape the narrative (or ensure buildNarrative returns an escaped string) before inserting it into the template.

Suggested change

	<div class="intent-label">Intent #${i + 1} — ${narrative}</div>
	<div class="intent-label">Intent #${i + 1} — ${esc(narrative)}</div>

[ojongerius]

Fixed in e4633aa — narrative is now escaped via esc() before interpolation into innerHTML.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 16 changed files in this pull request and generated 7 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

handleApprove/handleDeny now require checkAuth when authToken is set, but the embedded dashboard JS currently posts to these endpoints without sending X-Beacon-Token (and beacon-proxy generates a non-empty token by default). This will make approve/deny actions from the dashboard fail with 401. Either expose the token to the dashboard in a safe way (and have JS include it), or default to auth-disabled unless explicitly configured.

[Copilot]

The approval token is always generated (when BEACON_AUTH_TOKEN is unset) and then logged in plaintext. This both leaks a credential into logs and, combined with the dashboard not sending the token, effectively breaks approve/deny from the UI. Consider defaulting to auth disabled unless explicitly configured, and avoid printing the token (or only print a one-time warning with guidance).

Suggested change

	// Generate auth token for approval endpoints
	authToken := os.Getenv("BEACON_AUTH_TOKEN")
	if authToken == "" {
	authToken = generateToken()
	}
	log.Printf("beacon: approval token: %s", authToken)
	// Configure auth token for approval endpoints
	authToken, ok := os.LookupEnv("BEACON_AUTH_TOKEN")
	authToken = strings.TrimSpace(authToken)
	if !ok || authToken == "" {
	// Default to auth disabled unless explicitly configured
	authToken = ""
	log.Printf("beacon: approval endpoints are unauthenticated; set BEACON_AUTH_TOKEN to enable authentication")
	} else {
	// Auth is enabled, but do not log the token value
	log.Printf("beacon: approval endpoint authentication enabled via BEACON_AUTH_TOKEN")
	}

[Copilot]

pendingCalls is populated before policy evaluation, but when the decision is block or a pause is ultimately denied/times out, the request is never forwarded to the server so no response will arrive to trigger cleanup in handleToolCallResponse. This leaves stale entries in pendingCalls (memory growth) and can also interfere if the client reuses JSON-RPC IDs. Ensure pendingCalls is removed (and the tool call marked completed/denied) on all non-forwarded paths.

[Copilot]

In the pause async goroutine, when approval is denied/timeout, the tool call is left in policy_action='pause' even though the final outcome is denial. Update the record to a terminal policy action (e.g. deny) and perform the same pendingCalls cleanup/completion you do for successful responses.

Suggested change

	}
	}
	p.Store.UpdateToolCallPolicy(tcID, "deny", nil)

[Copilot]

entry.DurationMs = &durationMs.Int64 stores a pointer to a loop-local sql.NullInt64 field. Since the same durationMs variable is reused across iterations, all IntentToolEntry.DurationMs pointers can end up aliasing and showing the last row’s value. Copy the value into a new int64 variable per row before taking its address.

Suggested change

	entry.DurationMs = &durationMs.Int64
	d := durationMs.Int64
	entry.DurationMs = &d

[Copilot]

The comment claims reading sequence/prev_hash inside a transaction makes the hash chain correct across multiple processes, but with a unique index on messages(sequence) this approach can still race: concurrent writers can both read the same last sequence and then one insert will fail (or require retry). Either change the implementation to acquire an IMMEDIATE/EXCLUSIVE write lock (or retry on unique/SQLITE_BUSY) or remove/adjust the claim.

Suggested change

	// Sequence and prev_hash are read from the DB within a transaction, so multiple
	// processes sharing the same database will produce a correct chain.
	// Sequence and prev_hash are read from the DB within a transaction, which keeps the
	// chain consistent for messages written by this process. Concurrent writers using
	// the same database can still race on the unique sequence constraint, so callers
	// should be prepared to handle insert errors (e.g. by retrying).

[Copilot]

tx.QueryRow(...).Scan(...) errors other than sql.ErrNoRows are currently ignored, which can silently reset prevHash/seq and produce an incorrect chain (or hide underlying DB issues). Handle unexpected scan errors explicitly and return them instead of continuing.

Suggested change

	if err == nil {
	prevHash = lastHash.String
	seq = lastSeq.Int64
	}
	// sql.ErrNoRows → empty DB, chain starts fresh
	if err != nil {
	if err != sql.ErrNoRows {
	return "", fmt.Errorf("query last message: %w", err)
	}
	// sql.ErrNoRows → empty DB, chain starts fresh
	} else {
	prevHash = lastHash.String
	seq = lastSeq.Int64
	}