Boards, step 6c: a security source and the Security starting board #2474

The forge now offers a Security starting board next to Usage and Crew, backed by three new admin-only board sources. bun test test/boards passes (112 tests) and tsc is clean. I did not run the full check; the forge runs it on this push.

New sources (src/boards/sources.ts, all owner: "admin"):

• signins reads the session table and exposes user_id and the created, expires and last-seen times.
• tokens reads the token table and exposes id, user_id, scope, and the created, last-used and expires times.
• adminActions reads event rows whose actor is an admin and exposes id, kind, repo_id, actor_id and created_at.

No token text, hash, token name, session id or event payload is listed, and nothing carries an IP.

Security board (src/boards/starting.ts):

• It is written once on boot and never overwritten, the same as Usage and Crew (.offered).
• It has seven panels:

- sign-ins per hour; - failed sign-ins per hour, by status; - total failed sign-ins; - tokens by scope; - tokens made per day; - admin actions per hour; - admin actions by kind.

Failed sign-ins: they are not a row anywhere. I count them from the existing usage source: POST /signin with a 4xx status, which covers wrong passwords (422) and rate-limited attempts (429). I did not add a table for them.

Tests:

• A non-admin and an agent get 403 on each new source, and an admin gets 200.
• A repo-scoped query on each new source returns no rows.
• None of the new sources lists a column named like a secret.
• The existing starting-board test now covers the Security board, so every panel runs on a fresh forge.

I also updated the README and the comment in src/main.ts. No dependency was added.

To try it, sign in as an admin, boot, and open /boards/security.

🤖 Generated with Claude Code

Closes #2460

The forge now offers a Security starting board next to Usage and Crew, backed by three new admin-only board sources. bun test test/boards passes (112 tests) and tsc is clean. I did not run the full check; the forge runs it on this push.

New sources (src/boards/sources.ts, all owner: "admin"):

• signins reads the session table and exposes user_id and the created, expires and last-seen times.
• tokens reads the token table and exposes id, user_id, scope, and the created, last-used and expires times.
• adminActions reads event rows whose actor is an admin and exposes id, kind, repo_id, actor_id and created_at.

No token text, hash, token name, session id or event payload is listed, and nothing carries an IP.

Security board (src/boards/starting.ts):

• It is written once on boot and never overwritten, the same as Usage and Crew (.offered).
• It has seven panels:

- sign-ins per hour; - failed sign-ins per hour, by status; - total failed sign-ins; - tokens by scope; - tokens made per day; - admin actions per hour; - admin actions by kind.

Failed sign-ins: they are not a row anywhere. I count them from the existing usage source: POST /signin with a 4xx status, which covers wrong passwords (422) and rate-limited attempts (429). I did not add a table for them.

Tests:

• A non-admin and an agent get 403 on each new source, and an admin gets 200.
• A repo-scoped query on each new source returns no rows.
• None of the new sources lists a column named like a secret.
• The existing starting-board test now covers the Security board, so every panel runs on a fresh forge.

I also updated the README and the comment in src/main.ts. No dependency was added.

To try it, sign in as an admin, boot, and open /boards/security.

🤖 Generated with Claude Code