Web UI: management control plane, config editor, diagnostics, service control, and live stats

.github/workflows/pr-ci.yml

@@ -48,27 +48,25 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libpcap-dev
 
-      - name: go vet
-        run: go vet ./...
-
       - name: Race-enabled tests
         run: go test -tags all -race -count=1 ./...
 
+      # golangci-lint runs via its dedicated action (caching, problem matchers)
+      # rather than from quality.sh, so it can hook into the GitHub UI; the
+      # script tolerates it being absent so a local run still covers vet/vuln/
+      # gosec. The vet + govulncheck + gosec gates are shared with local
+      # development via scripts/ci/quality.sh / `make quality`.
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v8
         with:
           version: latest
           args: --build-tags=all
 
-      - name: govulncheck
-        run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
-          govulncheck -tags all ./...
-
-      - name: gosec (untrusted-input paths)
-        run: |
-          go install github.com/securego/gosec/v2/cmd/gosec@latest
-          gosec -tags all ./service/macip/... ./service/macgarden/... ./service/afpfs/macgarden/...
+      - name: Quality gates (vet + govulncheck + gosec)
+        shell: bash
+        env:
+          SKIP_LINT: "1" # golangci-lint already ran via its action above
+        run: bash scripts/ci/quality.sh
 
   build-tags:
     name: Build-tag matrix

.gitignore

@@ -8,6 +8,10 @@
 *.so
 *.dylib
 
+# Locally built command binaries (extensionless on Unix)
+/classicstack
+/classicstackd
+
 # Test binary, built with `go test -c`
 *.test
 
@@ -44,3 +48,5 @@ go.work.sum
 .captures/
 captures/
 
+server.toml.[0-9]*
+

CLAUDE.md

@@ -46,10 +46,10 @@ go test ./service/afp/...
 ### Core Data Flow
 
 ```
-cmd/classicstack/main.go  →  Ports  →  Router  →  Services
+cmd/classicstack/main.go  →  internal/app (run-core)  →  Ports  →  Router  →  Services
 ```
 
-1. **Entry point** (`cmd/classicstack/`) parses CLI flags and `server.toml`, constructs ports, wires them to the router, and starts services.
+1. **Entry point** (`cmd/classicstack/`) is a thin `main()` that calls `internal/app`, which parses CLI flags and `server.toml`, constructs ports, wires them to the router, and starts services. Two sibling commands wrap the same run-core for background operation: `cmd/classicstack-svc` (Windows service) and `cmd/classicstackd` (Unix/macOS daemon).
 2. **Router** (`router/`) receives DDP datagrams from all ports, maintains the `RoutingTable` and `ZoneInformationTable`, and dispatches to services by socket number or forwards to other ports.
 3. **Ports** (`port/`) abstract network interfaces. All implement `port.Port` (Unicast/Broadcast/Multicast). Implementations: `ethertalk`, `localtalk/ltoudp`, `localtalk/tashtalk`, `localtalk/virtual`.
 4. **Services** (`service/`) plug into the router by registering socket numbers. Each implements `service.Service`.
@@ -58,6 +58,10 @@ cmd/classicstack/main.go  →  Ports  →  Router  →  Services
 
 | Package | Role |
 |---|---|
+| `internal/app/` | The run-core (formerly `cmd/classicstack` package `main`): flag/TOML parsing, the `Supervisor`, every `wireXxx` hook, control-plane + web UI wiring. Exposes `Main(Version)` and `Run(ctx, args, Version)` so the interactive binary and the service/daemon wrappers all share one runtime. |
+| `cmd/classicstack/` | Thin interactive entry point (`main()` → `app.Main`); holds the link-time `Build*` vars (`-ldflags -X main.Build...`). |
+| `cmd/classicstack-svc/` | Windows service wrapper (SCM via `golang.org/x/sys/windows/svc`); `install`/`uninstall`/`start`/`stop`/`status`/`run`. Stub on non-Windows. |
+| `cmd/classicstackd/` | Unix/macOS background daemon (self-daemonize via fork+`Setsid`, PID file); `start`/`stop`/`status`/`run`, plus macOS LaunchAgent `install`/`uninstall`. Stub on Windows. |
 | `appletalk/` | DDP datagram struct, encode/decode, MacRoman codec |
 | `router/` | Core routing engine, routing table aging, zone info |
 | `port/ethertalk/` | EtherTalk over raw Ethernet using libpcap/Npcap, includes AARP |
@@ -69,8 +73,21 @@ cmd/classicstack/main.go  →  Ports  →  Router  →  Services
 | `service/atp/` | AppleTalk Transaction Protocol — reliable messaging |
 | `service/dsi/` | Data Stream Interface — AFP transport over TCP |
 | `service/macip/` | IP-over-AppleTalk gateway with NAT and DHCP relay |
+| `service/webui/` | Management web UI (`-tags webui`): HTTPS adapter over `pkg/control` — JSON API, SSE stats stream, embedded SPA |
+| `pkg/control/` | Transport-agnostic management API (status, config stage/apply/save, service start/stop/restart, diagnostics); the single contract every UI front-end shares |
+| `pkg/status/` | In-process service-status registry read by the dashboard |
+| `pkg/metrics/` | Streaming stats hub (expvar + SSE sinks) |
+| `pkg/logbuf/` | In-memory log ring buffer + `slog.Handler` + broadcaster feeding the web UI log viewer (installed via `logging.Options.Extra`) |
+| `pkg/serialport/` | Per-OS serial-port enumeration for the TashTalk dropdown |
+| `config/` | Config loader plus `Model` (in-memory, editable, serialisable view of `server.toml` with numbered-backup Save) |
 | `netlog/` | Structured logger with debug/info/warn levels |
 
+The `cmd/classicstack` `Supervisor` owns the whole runtime: it builds ports, the
+router (and its DDP service set), and the standalone hooks from the config
+`Model`, and exposes per-service Start/Stop/Restart (dependency-aware) that the
+web UI drives through `pkg/control`. `main.go` only parses flags / loads TOML,
+builds the `Model`, and hands off to the supervisor.
+
 ### AFP Architecture
 
 AFP supports two transport stacks simultaneously: