Show CPU, memory and disk meters on the Servers list#1699

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f904edf5-1e20-4a5c-9fc2-abc6bd78657d

📥 Commits

Reviewing files that changed from the base of the PR and between 7df981d520e9bed2957f0ff3bd97785c1bc0e455 and 83df2d5c1e895e88eecab34ccfd208a664111b7e.

📒 Files selected for processing (1)

• dashboard/src/collections/data-boundaries.static.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• dashboard/src/collections/data-boundaries.static.test.ts

Limit details: You’ve used all 10 included reviews currently available.

Summary by CodeRabbit

• New Features
  • The server list shows current CPU, memory, and disk usage on wide screens, with clear messages when a server is offline, needs an upgrade, or has no recent readings.
  • Verification mode can display sample servers and Runtime Watch data without connecting to real servers.
• Documentation
  • Updated server management guidance to explain the metrics and availability messages.

The Servers list now displays per-server CPU, memory, and disk readings on wide viewports. The change adds metric freshness handling, status messages, and a fake Runtime Watch mode with fixtures for verification.

Changes: Server Metrics in the Servers List

Layer / File(s)	Summary
Convert metrics to current readings dashboard/src/routes/_protected/cloud/$organizationSlug/_org/~/servers/-components/server-now.ts, dashboard/src/routes/_protected/cloud/$organizationSlug/_org/~/servers/-components/server-now.test.ts	Maps availability states to result states and filters CPU, memory, and disk readings by freshness. Tests cover newest samples, missing or old readings, and availability mappings.
Render metrics in server rows dashboard/src/hooks/use-media-query.ts, dashboard/src/components/metric-meter.tsx, dashboard/src/routes/_protected/cloud/$organizationSlug/_org/~/servers/-components/server-meters.tsx, dashboard/src/routes/_protected/cloud/$organizationSlug/_org/~/servers/index.tsx, dashboard/src/routes/_protected/cloud/$organizationSlug/_org/~/servers/-components/server-meters.test.tsx, dashboard/src/collections/data-boundaries.static.test.ts, docs/user/servers/manage-servers.md	Adds responsive per-server metrics, status messages, and meters. The route renders the component for each server. Tests cover offline servers and viewport-dependent reads; documentation describes the displayed states.
Add fake Runtime Watch verification dashboard/scripts/verify/up.sh, dashboard/src/modules/metrics/metrics.verify-fixture.ts, dashboard/src/modules/runtime/runtime-watch.verify-fixture.ts, dashboard/src/modules/runtime/runtime-watch.server.ts, .agents/skills/verify-dashboard/SKILL.md	Sets PLOYZ_VERIFY_RUNTIME for fake-server verification and supplies fixture Runtime Watch frames. Documentation describes the fixture server states and their limits.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature · Unblocks: 1 PR

Sequence Diagram(s)

mermaid

1	sequenceDiagram
2	participant ServersPage
3	participant ServerMeters
4	participant serverMetricsQueryOptions
5	participant serverNow
6	participant MetricMeter
7	ServersPage->>ServerMeters: Render a server row
8	ServerMeters->>serverMetricsQueryOptions: Read metrics when wide and server is online
9	serverMetricsQueryOptions-->>ServerMeters: Return metrics
10	ServerMeters->>serverNow: Convert metrics to current readings
11	serverNow-->>ServerMeters: Return availability and meter values
12	ServerMeters->>MetricMeter: Render CPU, memory, and disk values

The declaration update adds no identified merge blocker. The Servers guide may misdescribe stale readings, and a narrow abort timing can stall fake-server verification; both warrant follow-up.

Access checks remain in place, and fake readings are restricted to development. Reusing a Server identity across organizations may cause cached readings to appear under the wrong organization. This is a limited data-isolation concern, not evidence of broader access or increased privileges.

Retained concerns

• Medium · security · inferred: The new Servers-list caller makes an organization-unpartitioned metrics cache reachable. If two organization views contain the same machineId, their identical five-minute query keys can reuse cached readings across organization ownership boundaries. Fresh backend authorization does not apply when a cached result is reused. Live duplicate identity reachability is not established, and explicit logout reloads the document.

Security review details

Security Blast Radius

• inferred — The identified concern is bounded to cached operational readings in a browser query-client lifetime, conditional on overlapping machine identities across organization views. The inspected new caller invokes a metrics read rather than a server mutation or deployment operation.

Security Findings and Attack Paths

• inferred — A conditional path exists when a user reads metrics in organization A and then views organization B with the same machineId and range in the same query-client lifetime: the shared key can return A's cached readings under B's row. Persistence permits that identity overlap, but production enrollment reachability was not established. This is not a demonstrated unauthorized backend read or cross-user disclosure.

Trust Boundaries and Controls

• observed — Organization authorization remains on fresh server reads and on the public Runtime Watch opening path. Explicit sign-out navigates with reloadDocument=true, which is counterevidence to cache retention through ordinary logout. Development fixture selection requires a server-side setting as well as development mode.

Resilience and Maintainability Implications

• observed — Metrics reads use Effect.scoped resource ownership. Runtime session finalizers remove registered sessions and close their resources; pairing-generation changes close affected sessions, and sustained pairing-check failures fail closed. These controls constrain resource and credential lifetime for the new callers, but do not partition their browser cache.

Hardening Proposals

• proposed — Partition server-metric query identity by organization and verify same-machineId navigation across organizations. Separately validate non-logout authentication transitions before relying on session lifetime as a cache-isolation control.

^Failed Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 12 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

^Passed Passed checks (4 passed)

Check name	Status	Explanation
Title check	Passed	The title clearly and concisely describes the main change: adding CPU, memory, and disk meters to the Servers list.
Description check	Passed	The description directly explains the Servers list metrics, freshness rules, row states, responsive behavior, verification setup, and testing.
Linked Issues check	Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	Passed	Check skipped because no linked issues were found for this pull request.

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.