Summary

CC#1's KR-MCP-CONSUMPTION ST2 (PR #113, 94e572d6) added last_check_at + last_error to the /api/mcp/clients/list payload and the MCPClient TS interface. The cockpit's MCPClientsPanel.tsx didn't yet render either field — this PR closes that loop.

Bucket: rafe-walker/kora-docs → 17_cc_bucket_prompts/KR-MCP-CLIENTS-HEALTH-DISPLAY.md.

What's in here

• Per-row collapsed view:
  • Clock icon + "checked Xs/Xm/Xh/Xd ago" next to the status pill (italic + muted "never checked" when null).
  • TimerOff "stale" chip when last_check_at is older than 10 min (2x the default 5-min KORA_MCP_HEALTH_CHECK_INTERVAL_SEC cadence — signals "heartbeat scheduler stopped firing" rather than tripping on every normal probe).
  • Red error line under the row when last_error is non-null (truncated to 80 chars, full text in title= tooltip).
• Per-row expanded view: new "Last Check" section with absolute timestamp + relative phrase + stale chip + full last_error in a <pre> for multi-line readability.
• Aggregate strip: errors count now unions status=error|unhealthy with last_error !== null (catches the connected-but-flapping case). New stale (>10m) count for endpoints whose heartbeat is silent.
• Helpers factored to web/src/lib/mcpHealth.ts so the threshold (STALE_CHECK_THRESHOLD_MS) + truncation cap (ERROR_TRUNCATE_LEN) live as named exports the source-pin tests can reference symbolically.

3-layer security contract

This iteration's specific risk: last_error is operator-readable text sourced from an MCP catalog probe (subprocess stderr / HTTP body) — i.e., untrusted input from a misbehaving MCP server.

1. Plain-text rendering via React's default child escaping — <script> tags in last_error render as text, never execute.
2. NO dangerouslySetInnerHTML anywhere in the panel. Backend test pins this via a comment-stripped grep so the warning comment in the source doesn't self-trigger, AND so a future "rich error rendering" edit gets caught.
3. TS type for last_error is plain string | null — no pre-parsed _html companion field exists on MCPClient.

Test plan

• tests/kora_cli/test_mcp_clients_health_display.py — 16 source-pin tests covering: file existence, dangerouslySetInnerHTML ban (with comment-stripping), last_error as JSX-child text node, stale threshold = 10 min, truncation cap = 80, helper exports + panel-import chain (so source-pins stay load-bearing), aggregate errors filter includes last_error, cron-regression sanity.
• pnpm tsc --noEmit clean.
• pnpm build clean.
• Manual smoke: load /mcp-clients, confirm relative timestamps, simulate stale by mocking the snapshot, confirm last_error renders as text not HTML.

Notes

• Pre-existing failures in test_web_server_mcp_clients.py (13 failed + 5 errors) confirmed present on bare feature/phase2-upgrades — NOT introduced by this PR. Likely fallout from PR feat(kora): KR-MCP-CONSUMPTION ST2 — active health-check + payload extension #113's status-derivation changes; flagging for a separate cleanup bucket.
• No FE test framework in repo (no vitest / jest / jsdom in web/package.json). Per the established CC#2 pattern (HB-PANEL, MCP-3, WEBHOOK-EVENTS, AGENT-ACTIVITY), FE invariants pin via Python source-grep tests + tsc/vite for type/compile correctness. Standing up a real component test runner is out of scope at <150 LOC.

🤖 Generated with Claude Code