feat: Claude Code Monitor — lanes, pipelines and a merged workspace

Internal SmartGift build of a Claude Code monitoring dashboard. Lanes: a durable unit of parallel agent work, one per working directory, tracked across session restarts. Managed lanes are git worktrees the dashboard provisions and can reset or remove behind a three-check destroy guard and a counted preflight; adopted lanes are directories you already own and are never destroyable. Pipelines: a lane moves through pipeline stages. A stage the agent declares with evidence renders green; a stage inferred from the tool-event stream renders dashed amber and never counts as done. Detection is forward-only within a 30-minute window, and never writes the declared stage. Workspace: one page at /run with a lane grid, the selected lane's pipeline, and a full Claude console behind a disclosure.
2026-07-29 17:07:45 +07:00
commit 794b240156
781 changed files with 220598 additions and 0 deletions
@@ -0,0 +1,279 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Networking module – Cloud-agnostic VPC / VNet / VCN abstraction
+#
+# Creates the foundational network topology: virtual network, public and
+# private subnets across availability zones, NAT gateway, internet gateway,
+# route tables, and security groups / firewall rules.
+# ─────────────────────────────────────────────────────────────────────────────
+
+locals {
+  name_prefix = lower(replace("${var.project_name}-${var.environment}", "_", "-"))
+
+  # Default AZs when none provided – derive from region
+  default_azs = [
+    "${var.region}a",
+    "${var.region}b",
+    "${var.region}c",
+  ]
+
+  availability_zones = length(var.availability_zones) > 0 ? var.availability_zones : local.default_azs
+
+  # Number of AZs determines subnet count
+  az_count = min(length(local.availability_zones), length(var.public_subnet_cidrs), length(var.private_subnet_cidrs))
+
+  common_tags = merge(
+    {
+      module = "networking"
+    },
+    var.tags,
+  )
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# VPC
+# ─────────────────────────────────────────────────────────────────────────────
+
+resource "aws_vpc" "main" {
+  cidr_block           = var.vpc_cidr
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-vpc"
+  })
+
+  lifecycle {
+    prevent_destroy = false
+  }
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Internet gateway
+# ─────────────────────────────────────────────────────────────────────────────
+
+resource "aws_internet_gateway" "main" {
+  vpc_id = aws_vpc.main.id
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-igw"
+  })
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Public subnets
+# ─────────────────────────────────────────────────────────────────────────────
+
+resource "aws_subnet" "public" {
+  count = local.az_count
+
+  vpc_id                  = aws_vpc.main.id
+  cidr_block              = var.public_subnet_cidrs[count.index]
+  availability_zone       = local.availability_zones[count.index]
+  map_public_ip_on_launch = true
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-public-${local.availability_zones[count.index]}"
+    tier = "public"
+  })
+}
+
+resource "aws_route_table" "public" {
+  vpc_id = aws_vpc.main.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.main.id
+  }
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-public-rt"
+  })
+}
+
+resource "aws_route_table_association" "public" {
+  count = local.az_count
+
+  subnet_id      = aws_subnet.public[count.index].id
+  route_table_id = aws_route_table.public.id
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# NAT gateway (single, in first public subnet – cost-conscious default)
+# ─────────────────────────────────────────────────────────────────────────────
+
+resource "aws_eip" "nat" {
+  domain = "vpc"
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-nat-eip"
+  })
+}
+
+resource "aws_nat_gateway" "main" {
+  allocation_id = aws_eip.nat.id
+  subnet_id     = aws_subnet.public[0].id
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-nat"
+  })
+
+  depends_on = [aws_internet_gateway.main]
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Private subnets
+# ─────────────────────────────────────────────────────────────────────────────
+
+resource "aws_subnet" "private" {
+  count = local.az_count
+
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = var.private_subnet_cidrs[count.index]
+  availability_zone = local.availability_zones[count.index]
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-private-${local.availability_zones[count.index]}"
+    tier = "private"
+  })
+}
+
+resource "aws_route_table" "private" {
+  vpc_id = aws_vpc.main.id
+
+  route {
+    cidr_block     = "0.0.0.0/0"
+    nat_gateway_id = aws_nat_gateway.main.id
+  }
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-private-rt"
+  })
+}
+
+resource "aws_route_table_association" "private" {
+  count = local.az_count
+
+  subnet_id      = aws_subnet.private[count.index].id
+  route_table_id = aws_route_table.private.id
+}
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Security groups
+# ─────────────────────────────────────────────────────────────────────────────
+
+# Public (load-balancer-facing)
+resource "aws_security_group" "public" {
+  name_prefix = "${local.name_prefix}-public-"
+  description = "Allow HTTPS/HTTP inbound and all outbound"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    description = "HTTPS"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "HTTP (redirect)"
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    description = "All outbound"
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-public-sg"
+  })
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# Private (container-facing)
+resource "aws_security_group" "private" {
+  name_prefix = "${local.name_prefix}-private-"
+  description = "Allow traffic from public SG to app and MCP ports"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    description     = "Application port from LB"
+    from_port       = var.app_port
+    to_port         = var.app_port
+    protocol        = "tcp"
+    security_groups = [aws_security_group.public.id]
+  }
+
+  ingress {
+    description     = "MCP sidecar port from LB"
+    from_port       = var.mcp_port
+    to_port         = var.mcp_port
+    protocol        = "tcp"
+    security_groups = [aws_security_group.public.id]
+  }
+
+  ingress {
+    description = "NFS (EFS) within VPC"
+    from_port   = 2049
+    to_port     = 2049
+    protocol    = "tcp"
+    self        = true
+  }
+
+  egress {
+    description = "All outbound"
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-private-sg"
+  })
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# EFS security group
+resource "aws_security_group" "storage" {
+  name_prefix = "${local.name_prefix}-storage-"
+  description = "Allow NFS access from private security group"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    description     = "NFS from private subnets"
+    from_port       = 2049
+    to_port         = 2049
+    protocol        = "tcp"
+    security_groups = [aws_security_group.private.id]
+  }
+
+  egress {
+    description = "All outbound"
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = merge(local.common_tags, {
+    Name = "${local.name_prefix}-storage-sg"
+  })
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
@@ -0,0 +1,53 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Networking module outputs
+# ─────────────────────────────────────────────────────────────────────────────
+
+output "vpc_id" {
+  description = "ID of the provisioned VPC"
+  value       = aws_vpc.main.id
+}
+
+output "vpc_cidr" {
+  description = "CIDR block of the VPC"
+  value       = aws_vpc.main.cidr_block
+}
+
+output "public_subnet_ids" {
+  description = "IDs of the public subnets"
+  value       = aws_subnet.public[*].id
+}
+
+output "private_subnet_ids" {
+  description = "IDs of the private subnets"
+  value       = aws_subnet.private[*].id
+}
+
+output "public_security_group_ids" {
+  description = "Security group IDs for public-facing resources (LB)"
+  value       = [aws_security_group.public.id]
+}
+
+output "private_security_group_ids" {
+  description = "Security group IDs for private resources (containers)"
+  value       = [aws_security_group.private.id]
+}
+
+output "storage_security_group_ids" {
+  description = "Security group IDs for persistent storage"
+  value       = [aws_security_group.storage.id]
+}
+
+output "nat_gateway_ip" {
+  description = "Public IP of the NAT gateway"
+  value       = aws_eip.nat.public_ip
+}
+
+output "internet_gateway_id" {
+  description = "ID of the internet gateway"
+  value       = aws_internet_gateway.main.id
+}
+
+output "availability_zones" {
+  description = "Availability zones used for deployment"
+  value       = local.availability_zones
+}
@@ -0,0 +1,69 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Networking module variables
+# ─────────────────────────────────────────────────────────────────────────────
+
+variable "project_name" {
+  description = "Project identifier used in resource naming"
+  type        = string
+}
+
+variable "environment" {
+  description = "Deployment environment (dev, staging, production)"
+  type        = string
+}
+
+variable "cloud_provider" {
+  description = "Target cloud provider (aws, gcp, azure, oci)"
+  type        = string
+}
+
+variable "region" {
+  description = "Cloud region for deployment"
+  type        = string
+}
+
+variable "vpc_cidr" {
+  description = "CIDR block for the virtual network"
+  type        = string
+  default     = "10.0.0.0/16"
+  validation {
+    condition     = can(cidrhost(var.vpc_cidr, 0))
+    error_message = "vpc_cidr must be a valid CIDR block."
+  }
+}
+
+variable "availability_zones" {
+  description = "List of availability zones for multi-AZ deployment"
+  type        = list(string)
+  default     = []
+}
+
+variable "public_subnet_cidrs" {
+  description = "CIDR blocks for public subnets (one per AZ)"
+  type        = list(string)
+  default     = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
+}
+
+variable "private_subnet_cidrs" {
+  description = "CIDR blocks for private subnets (one per AZ)"
+  type        = list(string)
+  default     = ["10.0.11.0/24", "10.0.12.0/24", "10.0.13.0/24"]
+}
+
+variable "app_port" {
+  description = "Application container port"
+  type        = number
+  default     = 4820
+}
+
+variable "mcp_port" {
+  description = "MCP sidecar container port"
+  type        = number
+  default     = 8819
+}
+
+variable "tags" {
+  description = "Resource tags"
+  type        = map(string)
+  default     = {}
+}