Metadata-Version: 2.4
Name: kneo-dash
Version: 0.7.0
Summary: Backend-for-frontend for Kneo Agent Dashboard, built on kneo-client
Author: Kneron, Inc. and kneo-dash contributors
License-Expression: MIT
Classifier: Development Status :: 3 - Alpha
Classifier: Framework :: FastAPI
Classifier: Intended Audience :: System Administrators
Classifier: Programming Language :: Python :: 3.12
Classifier: Typing :: Typed
Requires-Python: >=3.12
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: kneo-client<2.0.0,>=1.1.0
Requires-Dist: fastapi<1.0,>=0.115
Requires-Dist: uvicorn[standard]<1.0,>=0.30
Requires-Dist: sse-starlette<4.0,>=3.0
Requires-Dist: prometheus-client<1.0,>=0.20
Requires-Dist: pydantic<3.0,>=2.0
Requires-Dist: pydantic-settings<3.0,>=2.0
Requires-Dist: authlib<2.0,>=1.3
Requires-Dist: itsdangerous<3.0,>=2.0
Provides-Extra: postgres
Requires-Dist: psycopg[binary]<4.0,>=3.1; extra == "postgres"
Provides-Extra: dev
Requires-Dist: pytest<10,>=8.0; extra == "dev"
Requires-Dist: pytest-asyncio<2.0,>=0.23; extra == "dev"
Requires-Dist: pytest-cov<8,>=5.0; extra == "dev"
Requires-Dist: httpx<1.0,>=0.27; extra == "dev"
Requires-Dist: respx<1.0,>=0.21; extra == "dev"
Requires-Dist: ruff<1.0,>=0.8; extra == "dev"
Requires-Dist: mypy<3.0,>=1.10; extra == "dev"
Requires-Dist: psycopg[binary]<4.0,>=3.1; extra == "dev"
Dynamic: license-file

# kneo-dash

The **backend-for-frontend (BFF)** for the **Kneo Agent Dashboard** — the
operational console for the [Kneo Agent Platform](https://github.com/kneo-agent).
A thin FastAPI layer over the typed [`kneo-client`](https://pypi.org/project/kneo-client/)
SDK: it answers an operator's five questions — *what is running, what is stuck,
what needs human action, what changed, is production healthy* — and serves the
dashboard SPA. It never imports `kneo-serv` and never puts platform API keys in
the browser.

This package runs either as the container image `ghcr.io/kneo-agent/kneo-dash`
(BFF + built SPA in one unit) **or** as the PyPI wheel — the published wheel
**bundles the built SPA** (ADR-011), so `pip install kneo-dash && kneo-dash` serves
the full app (UI + API) same-origin, no container. (A source/editable build without
the SPA staged runs API-only.)

## Install

```bash
pip install kneo-dash
```

## Run

The platform connection comes from the `kneo-client` profile environment
(`KNEO_URL` + `KNEO_API_KEY`, or a `~/.config/kneo/client.toml` profile):

```bash
# Local/trial: KNEO_DASH_DEV_MODE=1 runs a single UNAUTHENTICATED operator (static mode).
# The BFF refuses to start in static mode without it (ADR-009 §5); for a real deployment
# use OIDC instead (KNEO_DASH_AUTH_MODE=oidc + KNEO_DASH_SESSION_SECRET + provider config).
KNEO_URL=https://your-kneo-serv KNEO_API_KEY=… KNEO_DASH_DEV_MODE=1 kneo-dash   # BFF on :8090
```

Dashboard-server settings use the `KNEO_DASH_` env prefix (e.g. `KNEO_DASH_AUTH_MODE`,
`KNEO_DASH_SESSION_SECRET`, `KNEO_DASH_DEFAULT_PROFILE`, `KNEO_DASH_CORS_ORIGINS`,
`KNEO_DASH_SPA_DIR`).

## Scope (through 0.6.0)

**0.6.0 (current release)** added beta-readiness / operability hardening — recovery / break-glass
(a restore-detection sentinel), a token-gated `/metrics` telemetry surface, and server-truth
capability gating (`/api/me`). **0.7.0** (in progress) is a documentation-excellence + a11y cut.
Earlier scope, cumulative:

**Container-free full install · review-hardening.** 0.5.0 bundles the built SPA into the wheel
**and** the sdist ([ADR-011](../docs/dev/adrs/011-spa-bundled-in-wheel-and-container.md)), so a
bare `pip install kneo-dash && kneo-dash` serves the full UI + API same-origin with no Docker;
it also clears a two-review punch list (workflow deep audit + external review) and lands the
frontend majors (React 19 · router 7). Builds on the 0.4.0 **auth · RBAC · dashboard config ·
hardening** cut, which itself builds on the 0.2.0 live-debugging core (runs
list + detail: status · trace · run-graph · continuation chain · replay/recovery ·
time-travel diff · live SSE trace tail; run control; the human-in-the-loop queue;
Launch Load → Deploy → Run). 0.3.0 wires the **governance** surfaces —
**audit** (search/paginate), **policies** (view · preview · update), and the
**credential-reference** inventory (references + scopes; secret values never
surfaced) — adds a **per-run policy report**, **session/thread grouping**, an
operator **Overview**, **HITL bulk resume**, **2-run compare**, **error clusters**,
**recover & continue**, and a client-side **run-bundle export**. It also introduces
the dashboard **state store** (SQLite by default — stdlib; optional Postgres via the
`[postgres]` extra + `KNEO_DASH_DB_URL`) backing operator **annotations**, **saved
Runs filters**, and **launch history / re-launch**. Since **0.4.0** the BFF
authenticates operators (OIDC) and enforces roles server-side, with a live Connections
env-switcher; run `KNEO_DASH_AUTH_MODE=oidc` (the unauthenticated static mode is dev-only
and refuses to start without `KNEO_DASH_DEV_MODE=1`).

## Links

- Source & docs: <https://github.com/kneo-agent/kneo-dash>
- License: MIT
