[Icaro0310]

DL-17a7 — Office eco panel

Diagnóstico

O painel eco do devin-office (#eco no index.html) já está operacional na VM. A cadeia completa funciona:

1. devin-office daemon no laptop coleta via ecomon.collect_eco() → serve /api/eco-raw na :8788
2. devin-vm-rtunnel.service faz -R 8788:localhost:8788 → VM alcança o daemon no loopback (sshd escutando :8788)
3. OFFICE_ECO_URL=http://127.0.0.1:8788/api/eco-raw no env PM2 do devin-office → hub.py faz proxy em /api/eco
4. Frontend faz fetch("/api/eco") → applyEco(data?.eco) → renderEcoPanel + toolRows (arms do canvas)

Verificado ao vivo na VM: GET http://127.0.0.1:8790/api/eco retorna {"eco": {"icaro-hpelitebookfolio1040g3": {probes, tools, units, meta}}, "office": {...}} com probe.live=true. Screenshot do painel renderizado com dados reais anexado na sessão.

O gap real

A missão DL-17a7 (backlog de antes do fix de 2026-11-06) reportava "nada serve esse endpoint" — resolvido na época pelo rtunnel+daemon. O que faltava era cobertura de teste: test_hub.py só assertava o caso disabled (ECO_URL vazio → eco=None). Nenhum teste travava a regressão do proxy funcionando.

O que este PR adiciona

• test_ecosystem_proxy_returns_upstream_data — sobe um servidor HTTP upstream real servindo um payload eco, aponta OFFICE_ECO_URL para ele, e assert que GET /api/eco retorna esse payload sob a chave "eco" junto ao office state. Teste de integração do caminho real (não mock interno).
• test_ecosystem_proxy_reports_unreachable_upstream — fallback quando o upstream está fora: eco = {"error": "ecosystem API unreachable"}.
• Helper _eco_upstream(payload) — ThreadingHTTPServer que serve JSON fixo (substituto do daemon /api/eco-raw).

Testes

packages/office: 63 passed (test_hub.py: 7/7)

Sem mudança de código de produção — só testes. Deploy VM não afetado (hub.py/index.html já corretos e divergentes de propósito: flat vs devin_office.*).

---

[github-actions]

Static scan (advisory) — result: EXECUTED

Deterministic scan of 1 changed file(s) — gitleaks 8.30.1 · semgrep 1.182.1 · ruff 0.17.3. Findings are advisory evidence for the judge, not a lane verdict.

gitleaks — 0 finding(s)

semgrep — 0 finding(s)

ruff (E9,F,S) — 6 finding(s)

• packages/office/tests/test_hub.py:38 S104 — Possible binding to all interfaces
• packages/office/tests/test_hub.py:41 S104 — Possible binding to all interfaces
• packages/office/tests/test_hub.py:51 S310 — Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
• packages/office/tests/test_hub.py:54 S310 — Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
• packages/office/tests/test_hub.py:61 S310 — Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
• packages/office/tests/test_hub.py:105 S310 — Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.

[devin-ai-integration]

Devin Review found 1 potential issue.

[Icaro0310]

devin-judge (ACP, high model): approve — {"samples": 1, "blocks": 0, "probs": [{"secrets": 0.02, "unsafe_code": 0.04, "deception": 0.03}]}

[github-actions]

Static scan (advisory) — result: EXECUTED

Deterministic scan of 2 changed file(s) — gitleaks 8.30.1 · semgrep 1.182.1 · ruff 0.17.3. Findings are advisory evidence for the judge, not a lane verdict.

gitleaks — 0 finding(s)

semgrep — 0 finding(s)

ruff (E9,F,S) — 6 finding(s)

• packages/office/tests/test_hub.py:38 S104 — Possible binding to all interfaces
• packages/office/tests/test_hub.py:41 S104 — Possible binding to all interfaces
• packages/office/tests/test_hub.py:51 S310 — Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
• packages/office/tests/test_hub.py:54 S310 — Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
• packages/office/tests/test_hub.py:61 S310 — Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
• packages/office/tests/test_hub.py:105 S310 — Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.

[Icaro0310]

devin-judge (ACP, high model): approve — {"samples": 1, "blocks": 0, "probs": [{"secrets": 0.03, "unsafe_code": 0.08, "deception": 0.04}]}

[github-actions]

gate-resolved-via: fallback — 1 blocking thread(s) cleared by replies citing verified fix commits, with the Devin Review status on 85a0c46 re-verified clean:

• thread PRRT_kwDOUzxHgc61SyHb via commit 85a0c46

Threads left unresolved — the findings stay visible.
gate-fallback-pairs: PRRT_kwDOUzxHgc61SyHb|commit:85a0c46 head:85a0c460f7d7cff171656f4f74d13efcfff4559d