# Agent Workbench dashboard template

A reusable React + TypeScript dashboard using Vite, Tailwind CSS and official
shadcn/ui components. All project data comes from the same-origin API. No
production fixtures, accounts, host inventories, credentials or screenshots are
included.

## Build and serve

Use Node.js 22.12 or newer (validated with Node.js 24) and npm:

```sh
npm ci
npm run build
```

Serve `dist/index.html` at `/` and `dist/assets/*` with the coordination API at
`/api/*`. Route selection lives in the URL hash, so the static server does not
need an SPA path fallback. Do not serve source files or `node_modules`.
`npm run preview` only previews static assets; an authenticated API is still
required. `npm run lint` checks the source; upstream shadcn sources can emit
React development/fast-refresh warnings without affecting a production build.

The official Radix/sidebar components use inline styles for dimensions and
positioning. A compatible CSP keeps scripts and connections at `'self'` while
allowing inline styles. No remote fonts, CDN scripts or external runtime assets
are required. Retain the server's authentication, Host/Origin and CSRF checks.

## Pages and data

- `#/overview`: summary, current phase, blockers, important reports and decisions.
- `#/tasks`: work packages, phase, ETA range and evidence.
- `#/cluster`: node memory/load, storage and scheduler queues; unknown is not zero.
- `#/communication`: the configured current/dedicated conversation and other sessions.
- `#/decisions`: pending task decisions and proposal/decision events.

`GET /api/state` provides the title from `config.title` (or `title`), falling back
to `Agent Workbench`. `primary_session_id` selects the current or dedicated session and
falls back to `wp4-progress` for compatibility. The UI never assumes the bound
conversation is WP4. An optional backend-provided `session.thread_url` matching
`codex://threads/<UUID>` enables the local original-session link; the client never
fabricates a URI from an unverified ID. An absent primary record disables sending; it never
silently redirects to a different session. History messages with
`origin: session_history` are labeled as synchronized source text.

The client reads `GET /api/messages?session_id=...` and writes
`POST /api/messages` and `POST /api/session-requests`. It sends a Bearer token
and `X-CSRF-Token: 1`. The token remains in React memory, never URL, localStorage
or sessionStorage. Refresh requires re-login while preserving route and selected
session. Polling is every three seconds, with cancellation and session scoping.
A send retry reuses its idempotency key. History synchronization and AI execution
are backend/worker responsibilities; the template never generates model replies.

## Fixed design system and upstream sources

`src/index.css` is the only palette definition: official zinc base plus official
blue primary, with named semantic success/danger/active state colors. Pages use
semantic tokens, not randomly selected per-project palettes.

The official `sidebar-07` and `login-01` blocks were installed using the official
`shadcn@4.22.1` CLI. Their project-specific adapters are `app-sidebar.tsx`,
`nav-main.tsx` and `login-form.tsx`. Underlying UI components are retained in
`src/components/ui`. Normal builds use the committed source snapshot and exact
npm lockfile; they do not fetch a registry or run the generator.

See `THIRD_PARTY_NOTICES.md`, `THIRD_PARTY_LICENSES.txt` and
`registry-provenance.json` for sources, licenses and content hashes.