- AuthGate replaces the raw token prompt: first-run setup form (creates
the admin) when no accounts exist, email/password sign-in with a
forgot-password flow, and a collapsible raw-API-token fallback for
legacy/script setups.
- /reset is a public page where invite and password-reset links land;
success stores the fresh session and enters the dashboard.
- Users section (admin-only nav): invite by email (link always shown,
emailed when SMTP is configured), admin/disable toggles, reset links,
and delete with the shared-resources handoff spelled out.
- Sidebar shows who is signed in; sign-out revokes the session
server-side.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ws7xj5Ej623hh4GXQCYYR
Rebuild the bundled web UI as a Next.js (React + TypeScript) static export
implementing the Claude Activity Dashboard design: a left-nav "Control Center"
hub over Runs, Repositories, Agents, Approvals, Git Servers, Activity, and
Shared, styled with the Leeworks design-system tokens (flat, dark, border-led).
The dashboard is a pure client of the existing API (same contract as curl):
the browser prompts for the token once, stores it in localStorage, attaches it
to every call, and renders all API values as React text so agent-authored
strings stay inert. Control actions enqueue a command and poll it to a terminal
state, matching the worker model.
The build output is committed to src/handler/api/static/ so the wheel ships it
and FastAPI serves it same-origin. app.py now mounts the export at "/" after the
API routers (a non-shadowing fallback: unmatched paths 404, no SPA rewrite).
UI-serving tests updated for the export; frontend source lives in frontend/.
Claude-Session: https://claude.ai/code/session_01ATgVWRjFzG8nHEnwgZpJWD
Co-authored-by: Claude <noreply@anthropic.com>
Claude