feat: Cost Control Center

[dreamwing]

Implementation of Cost Control Center frontend and backend as specified in the PRD. Includes diagnostic engine, optimizer service, and dashboard UI.

[dreamwing]

@codex review please~

[dreamwing]

@greptileai review thx~

[greptile-apps]

Greptile Summary

This PR implements the Cost Control Center: a diagnostics engine (D01–D09), an optimizer service (A01–A09), new API routes, and a substantially reworked dashboard UI. The architecture is well-structured — the action whitelist, backup-before-modify pattern, and idempotent A09 marker are all solid — but two issues were found that need attention before merging.

• Stored XSS in Missions tab (dashboard.js line 422): scriptPath, extracted from a cron job's payload text via regex, is inserted into div.innerHTML without escapeHtml. A cron job whose payload embeds <script> or <img onerror=…> tags in its .js path string would execute arbitrary JavaScript in the dashboard viewer's browser. Fix: wrap with escapeHtml(scriptPath).
• 7-day effect tracking is dead code (optimizer.js line 335): logOptimization accepts a preOptCostSnapshot field that the UI in renderHistoryList relies on (gated by hist.preOptCostSnapshot && daysSince >= 7), but applyAction never captures or passes the pre-optimization monthly cost. The effect tag is therefore never rendered, even for optimizations applied weeks ago.
• New backend services (diagnostics.js, optimizer.js, pricing.js, openclaw_config.js) use execFile with fixed argument arrays (no shell injection), properly validate action IDs against a whitelist, and protect the undo endpoint from path traversal via path.basename.
• New safeCompare utility correctly normalises key lengths via SHA-256 before timingSafeEqual, avoiding the length-leaking shortcut that a naive implementation would have.

Confidence Score: 3/5

• Not safe to merge as-is — one stored XSS and one silently broken feature need to be addressed first.
• The two issues found are meaningful: the unescaped scriptPath is a stored XSS that can be triggered by a crafted cron job, and the missing preOptCostSnapshot leaves a fully implemented feature permanently broken. The rest of the new code is well-guarded (whitelist validation, timing-safe auth, path-traversal protection on the undo endpoint), which keeps the overall score from dropping lower.
• public/js/dashboard.js (unescaped scriptPath XSS) and src/services/optimizer.js (missing preOptCostSnapshot in logOptimization call).

Important Files Changed

Filename	Overview
src/services/optimizer.js	New optimizer service applying A01–A09 actions; path traversal protection for A04 is solid, but preOptCostSnapshot is never passed to logOptimization, permanently disabling the 7-day effect tracking feature.
public/js/dashboard.js	Major rewrite of the dashboard frontend including optimizer UI; unescaped scriptPath in fetchJobs is a stored XSS vector, and the 7-day effect tracking renders dead HTML due to the missing preOptCostSnapshot on the server side.
src/services/diagnostics.js	New diagnostics engine (D01–D09) with configurable thresholds, 60s cache, and multi-interval heartbeat options; logic and savings calculations are sound.
src/services/pricing.js	New pricing service loading model rates from a local JSON file; replacement ratio calculation is correct and legacy fallback is clearly documented.
src/routes/optimizations.js	New undo/history routes; path traversal is properly mitigated via path.basename before resolve, and security check is defense-in-depth.
src/routes/optimize.js	New optimization apply route; action_id is validated against a whitelist in the service layer, input types are validated, and auth is applied globally.
src/auth/utils.js	New safeCompare utility using SHA-256 hashing for length normalisation before timingSafeEqual; timing-safe comparison is correctly implemented for both equal- and unequal-length inputs.
src/utils/paths.js	New shared home/config directory resolver; correctly handles OPENCLAW_HOME tilde expansion and OPENCLAW_STATE_DIR override.
src/services/openclaw_config.js	New config manager wrapping the openclaw CLI with a direct JSON file fallback; uses execFile (not exec) with a fixed argument array, avoiding shell injection.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Browser: Dashboard UI] -->|GET /api/diagnostics| B[diagnostics.js\nRunDiagnostics]
    B --> C{Cache fresh?}
    C -- Yes --> D[Return cached result]
    C -- No --> E[Load thresholds\nfrom config JSON]
    E --> F[Read token stats\nlatest.json]
    F --> G[Run D01–D09\nchecks]
    G --> H[pricingService\ngetReplacements]
    H --> G
    G --> I[Cache & return\nactions + savings]
    I --> D

    A -->|POST /api/optimize/:id| J[optimize.js route]
    J --> K[optimizerService\napplyAction]
    K --> L[backupConfig\ndata/backups/]
    L --> M{action}
    M -- A01/A02/A05/A06/A07 --> N[openclaw_config\nsetConfig via CLI]
    M -- A04 --> O[Move skill folders\nto backup dir]
    M -- A09 --> P[Append to SOUL.md\nif marker absent]
    N & O & P --> Q[logOptimization\ndata/logs/*.jsonl]
    Q --> R[invalidateCache\ndiagnosticsEngine]

    A -->|POST /api/optimizations/undo| S[optimizations.js route]
    S --> T[path.basename\ntraversal guard]
    T --> U[restoreBackup\nfrom JSON snapshot]
    U --> R

Loading

_{Last reviewed commit: 82f07eb}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9fbc8c16c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[greptile-apps]

7-day effect tracking permanently broken

The logOptimization call here never passes preOptCostSnapshot, so it is always stored as null in the JSONL file. The 7-day post-optimization effect feature in renderHistoryList (dashboard.js line 969) is gated on hist.preOptCostSnapshot && …, which will always be falsy. The entire effect-tracking UI path (effectHtml) is effectively dead code.

To fix this, the current monthly cost must be captured before applying the action and passed through:

// Fetch pre-optimization cost snapshot before applying changes
let preOptCostSnapshot = null;
try {
    const diag = await diagnosticsEngine.runDiagnostics();
    preOptCostSnapshot = diag.currentMonthlyCost ?? null;
} catch (_) { /* non-blocking */ }

// ... (existing switch/case logic) ...

await this.logOptimization({
    actionId,
    title: details.title,
    savings: details.savings,
    configChanged: details.configChanged,
    backupPath,
    preOptCostSnapshot,   // ← add this
    undoable: !!backupPath
});

[greptile-apps]

Stored XSS via unescaped scriptPath in job list

scriptPath is extracted from the cron job's payload text with a regex, but it is interpolated directly into the pathHtml string without HTML-escaping before being assigned to div.innerHTML. The [^']+ pattern in the regex does not restrict <, >, or other HTML metacharacters, so a cron job with a payload like:

node '/path/to/<img src=x onerror=alert(document.cookie)>.js'

would cause arbitrary JavaScript execution when the Missions tab is viewed.

Use escapeHtml on scriptPath:

Suggested change

	if (status === 'ok') badgeClass = 'ok';
	if (status === 'error' || status === 'skipped') badgeClass = 'fail';
	// Deduplication Logic
	const firstItem = feed.firstElementChild;
	if (firstItem) {
	const textSpan = firstItem.querySelector('span:last-child');
	if (textSpan && textSpan.innerText === task) {
	// Match found! Update time instead of adding new row.
	const timeSpan = firstItem.querySelector('span:first-child');
	const time = new Date(ts).toLocaleTimeString('en-US', { hour12: false });
	timeSpan.innerText = time;
	// Flash effect
	firstItem.style.background = 'rgba(255,255,255,0.1)';
	setTimeout(() => firstItem.style.background = 'transparent', 300);
	return;
	}
	}
	const div = document.createElement('div');
	div.className = 'job-item';
	if (scriptPath) {
	pathHtml = `<div style="font-family:monospace; font-size:10px; color:var(--text-dim); margin-top:3px; word-break:break-all; opacity:0.7;">
	📄 ${escapeHtml(scriptPath)}
	</div>`;
	}