fix(bx): address Copilot review findings on #61

- statusMonitor.Start now guards against multi-start with sync.Once
  (matches its docstring; previously spawned a new goroutine per call).
- bx.Gear.Start passes its lifecycle ctx through to the monitor instead
  of context.Background(), so framework shutdown actually cancels it.
- The per-probe 5s budget is now enforced: probe uses
  agent.NewClientWithTimeout(..., m.timeout) instead of the default 30s
  agent client. Removed the unused pctx that the old comment promised.
- canViewIntegration("bx") now checks bx:view via
  auth.HasPermissionFromContext, matching the handler-side gate and the
  SidebarItem.RequiresPermission — so the sidebar no longer renders a
  Bx link for users who'd just get a 403 clicking it.
- Fix stale comment on boxTable: the page reconciles via the SSE
  snapshot pushed on (re)connect, not a /bx/api/status fetch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sarg3nt

gearbox/internal/framework/templates/layouts/base.templ

@@ -1758,7 +1758,11 @@ func firstEnabledIntegrationPath(ctx context.Context) string {
 func canViewIntegration(ctx context.Context, integrationName string) bool {
 	switch integrationName {
 	case "bx":
-		return true // Bx (fleet view) is the box switcher's home — always visible.
+		// Bx (fleet view) is gated on bx:view in handlers and the sidebar
+		// config (SidebarItem.RequiresPermission); mirror that here so the
+		// sidebar link doesn't render for users who'd get a 403 clicking it.
+		// `models.Component("bx")` matches the gear-declared permission name.
+		return auth.HasPermissionFromContext(ctx, models.Component("bx"), models.PermissionView)
 	case "home":
 		return true // Home is visible to all authenticated users when enabled.
 	case "metrics":

gearbox/internal/gears/bx/gear.go

@@ -57,7 +57,7 @@ func (g *Gear) Initialize(ctx context.Context, deps gear.Dependencies) error {
 // Start launches the per-box status poller.
 func (g *Gear) Start(ctx context.Context) error {
 	if g.monitor != nil {
-		g.monitor.Start(context.Background())
+		g.monitor.Start(ctx)
 	}
 	return nil
 }

gearbox/internal/gears/bx/pages.templ

@@ -129,8 +129,8 @@ templ emptyState() {
 }
 
 // boxTable renders the fleet view. Server-side render is the source of truth
-// for initial paint; the page's JS reconciles rows with /bx/api/status and
-// listens on /bx/api/events for live updates.
+// for initial paint; the page's JS subscribes to /bx/api/events (SSE), which
+// pushes a full snapshot on every (re)connect and live transitions thereafter.
 //
 // Column order is deliberately minimal: status dot, name, location, agent
 // host, latency, last-checked. Anything heavier (per-box CPU/mem

gearbox/internal/gears/bx/status.go

@@ -57,8 +57,9 @@ type statusMonitor struct {
 	mu       sync.RWMutex
 	statuses map[string]BoxStatus // keyed by BoxConfig.ID (UUID string)
 
-	stop chan struct{}
-	once sync.Once
+	stop      chan struct{}
+	startOnce sync.Once
+	stopOnce  sync.Once
 
 	subsMu sync.Mutex
 	subs   map[int64]chan BoxStatus
@@ -83,14 +84,14 @@ func newStatusMonitor(deps gear.Dependencies) *statusMonitor {
 }
 
 // Start launches the polling loop. Safe to call multiple times — only the
-// first call wins.
+// first call wins; subsequent calls are no-ops.
 func (m *statusMonitor) Start(ctx context.Context) {
-	go m.run(ctx)
+	m.startOnce.Do(func() { go m.run(ctx) })
 }
 
 // Stop signals the polling loop to exit. Subsequent calls are no-ops.
 func (m *statusMonitor) Stop() {
-	m.once.Do(func() { close(m.stop) })
+	m.stopOnce.Do(func() { close(m.stop) })
 }
 
 func (m *statusMonitor) run(ctx context.Context) {
@@ -164,14 +165,9 @@ func (m *statusMonitor) probe(ctx context.Context, b *database.BoxDB, apiKey str
 		return bs
 	}
 
-	// Per-probe context bounded by the timeout; do not let a single hung
-	// agent stall the whole poll cycle.
-	pctx, cancel := context.WithTimeout(ctx, m.timeout)
-	defer cancel()
-	_ = pctx // reserved for when the agent client supports ctx; the http
-	// client's per-request timeout already provides the upper bound.
-
-	client := agent.NewClient(b.AgentURL, apiKey)
+	// Per-probe timeout bounds the HTTP request itself so a single hung
+	// agent can't stall the poll cycle past m.timeout.
+	client := agent.NewClientWithTimeout(b.AgentURL, apiKey, m.timeout)
 	t0 := time.Now()
 	_, err := client.Health()
 	bs.LatencyMs = time.Since(t0).Milliseconds()