refactor(hive-c0re): shrink dashboard mod root

convert to dashboard/mod.rs; state snapshot, meta inputs, tombstones,
and misc api handlers move to their own files

hive-c0re/src/dashboard/tombstones.rs

@@ -0,0 +1,159 @@
+//! Tombstone rows for the dashboard: state dirs surviving a
+//! destroy-without-purge. Builds `TombstoneView`s for the snapshot,
+//! emits the `TombstonesChanged` event after mutations, and handles
+//! `POST /api/purge-tombstone/{name}`.
+
+use std::path::Path;
+use std::sync::Arc;
+
+use axum::{
+    extract::{Path as AxumPath, State},
+    http::StatusCode,
+    response::{IntoResponse, Response},
+};
+use serde::Serialize;
+
+use crate::container_view::{ContainerView, claude_has_session};
+use crate::coordinator::Coordinator;
+use crate::lifecycle;
+
+use super::{AppState, error_response, validate_agent_name};
+
+#[derive(Serialize, Clone, Debug)]
+pub struct TombstoneView {
+    pub name: String,
+    /// Bytes used by the state dir tree. Cheap-ish to compute; let the
+    /// operator know how much they're holding onto.
+    pub state_bytes: u64,
+    /// Mtime (unix seconds) of the state dir; rough "last seen".
+    pub last_seen: i64,
+    pub has_creds: bool,
+}
+
+/// State-dir names that don't appear in the live container list. Each
+/// one surfaces in the dashboard as a row with R3V1V3 + PURG3 actions.
+pub(super) fn build_tombstone_views(
+    coord: &Coordinator,
+    containers: &[ContainerView],
+    transient_snapshot: &std::collections::HashMap<String, crate::coordinator::TransientState>,
+) -> Vec<TombstoneView> {
+    let _ = coord; // kept_state_names is a free fn but takes &self by future plan
+    let live: std::collections::HashSet<&str> = containers
+        .iter()
+        .map(|c| c.name.as_str())
+        .chain(transient_snapshot.keys().map(String::as_str))
+        .collect();
+    Coordinator::kept_state_names()
+        .into_iter()
+        .filter(|name| !live.contains(name.as_str()))
+        .map(|name| {
+            let root = Coordinator::agent_state_root(&name);
+            let state_bytes = dir_size_bytes(&root);
+            let last_seen = std::fs::metadata(&root)
+                .and_then(|m| m.modified())
+                .ok()
+                .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+                .and_then(|d| i64::try_from(d.as_secs()).ok())
+                .unwrap_or(0);
+            let has_creds = claude_has_session(&Coordinator::agent_claude_dir(&name));
+            TombstoneView {
+                name,
+                state_bytes,
+                last_seen,
+                has_creds,
+            }
+        })
+        .collect()
+}
+
+/// Sum the byte size of every regular file under `root`. Cheap to compute
+/// for typical agent state (config repo + claude creds + notes file —
+/// usually a few MB); fine to do inline on each /api/state. Returns 0 on
+/// any error.
+fn dir_size_bytes(root: &Path) -> u64 {
+    fn walk(p: &Path, acc: &mut u64) {
+        let Ok(rd) = std::fs::read_dir(p) else { return };
+        for entry in rd.flatten() {
+            let Ok(ft) = entry.file_type() else { continue };
+            if ft.is_dir() {
+                walk(&entry.path(), acc);
+            } else if ft.is_file()
+                && let Ok(meta) = entry.metadata()
+            {
+                *acc += meta.len();
+            }
+        }
+    }
+    let mut total = 0u64;
+    walk(root, &mut total);
+    total
+}
+
+/// Snapshot the current tombstone list and emit a
+/// `TombstonesChanged` event. Call after any mutation that could
+/// add or remove a tombstone (`actions::destroy`,
+/// `post_purge_tombstone`, spawn finalisation). Cheap — the list
+/// is tiny.
+pub(crate) async fn emit_tombstones_snapshot(coord: &Arc<Coordinator>) {
+    let containers = coord.containers_snapshot().await;
+    let transient_snapshot = coord.transient_snapshot();
+    let tombstones = build_tombstone_views(coord, &containers, &transient_snapshot);
+    coord.emit_dashboard_event(crate::dashboard_events::DashboardEvent::TombstonesChanged {
+        seq: coord.next_seq(),
+        tombstones,
+    });
+}
+
+pub(super) async fn post_purge_tombstone(
+    State(state): State<AppState>,
+    AxumPath(name): AxumPath<String>,
+) -> Response {
+    // Format guard FIRST so a name like `..` can't traverse into the
+    // parent of `/var/lib/hyperhive/agents/{name}` and have
+    // `remove_dir_all` wipe `/var/lib/hyperhive/` itself. Existing
+    // manager + live-container checks below don't catch `..` — only
+    // the whitelist does. Existence check via
+    // `containers_snapshot()` is deliberately NOT used here:
+    // tombstoned agents are gone from the snapshot by design; that's
+    // the whole point of this endpoint.
+    if let Some(reason) = validate_agent_name(&name) {
+        return (StatusCode::BAD_REQUEST, format!("bad agent name: {reason}")).into_response();
+    }
+    // Sanity: refuse to purge if a live container still exists with this
+    // name. The dashboard already filters tombstones to non-live names,
+    // but the operator could send a stale POST.
+    let live = lifecycle::list().await.unwrap_or_default();
+    if live
+        .iter()
+        .any(|c| c == &format!("{}{name}", lifecycle::AGENT_PREFIX) || c == &name)
+    {
+        return error_response(&format!(
+            "refusing to purge {name}: container still exists — use DESTR0Y first"
+        ));
+    }
+    let mut errors = Vec::new();
+    for dir in [
+        Coordinator::agent_state_root(&name),
+        Coordinator::agent_applied_dir(&name),
+    ] {
+        if dir.exists()
+            && let Err(e) = std::fs::remove_dir_all(&dir)
+        {
+            errors.push(format!("{}: {e}", dir.display()));
+        }
+    }
+    let _ = state
+        .coord
+        .approvals
+        .fail_pending_for_agent(&name, "agent state purged");
+    if errors.is_empty() {
+        tracing::info!(%name, "tombstone purged");
+        // Fire the post-purge tombstones snapshot so dashboards
+        // drop the row live; matching form carries
+        // `data-no-refresh`.
+        emit_tombstones_snapshot(&state.coord).await;
+        (StatusCode::OK, "ok").into_response()
+    } else {
+        error_response(&format!("purge {name} partial: {}", errors.join(", ")))
+    }
+}