[willwashburn]

Routes /dashboard/* to the standalone static SPA on the existing marketing origin, with /login and authenticated /cloud/api using the existing shared-origin HttpOnly session cookie. No alternate authentication or CORS is introduced.

The optional DASHBOARD_ASSETS binding receives the path with /dashboard stripped and no cookie/authorization headers. With the binding available, the root canonicalizes to /dashboard/ and writes return 405. A missing binding returns an uncached 503. The binding remains disabled; the router README records rollout order and rollback.

The development-only Next rewrite accepts only HTTP loopback origins. Its regression test now uses the normal Vitest TypeScript runner; the former .mjs test was excluded by the CI include patterns.

Validation on 4ca656cf84918be30d9f4107662ae3671f953a95, composed with current main fad47a04537a338ec9fb9650821724b26ab33214:

• Real root npm ci; both web/router workspace links resolve inside the T7 worktree.
• npm test: 55 web files / 619 tests, 12 router files / 123 tests, including all 13 proxy cases.
• npm run typecheck: both workspaces passed.
• npm run lint: no errors; four existing warnings outside this change.
• Negative controls: removing the dashboard rewrite makes 10 cases fail; removing origin validation makes 7 fail; enabling it outside development makes 2 fail. Source restored byte-for-byte; all 13 pass.
• npm run build: compilation, TypeScript and 252 static pages completed, then the existing Next 16.4.0 security check exited 1. This is not a green build. Existing security PR security: upgrade Next.js to 16.4.3 #252 supplies the patched version; no duplicate upgrade is included here.
• Current-head remote CI is now green: Tests42084249657 and Verify42084249702. Both job logs show actual Checkout 505e748e7f2e6d5ebe276763ee936ff5228724d9; its source parent is4ca656c and its tree exactly matches the locally validated tree. Existing CI also ran its automatic preview42084249645; no manual preview action was taken.

Keep draft until the dependency/build gate, two recorded reviews, and the real shared-origin Google/provider/dashboard journey are settled. Google configuration is available privately; live QA has not run. Local port 3100 belongs to a separate checkout and was left untouched. No manual deployment/preview, binding enablement, or production OAuth change was initiated.

Companions:

• security: upgrade Next.js to 16.4.3 #252
• Add minimal Cloud session list dashboard relay-dashboard#77
• https://github.com/AgentWorkforce/cloud/pull/5881

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Routes /dashboard/* to a standalone SPA while keeping /login as the marketing login page and /cloud/api as the Cloud backend, so the browser reuses the existing shared-origin HttpOnly session cookie without new login UI or CORS.

• /dashboard canonicalizes to /dashboard/, non-GET/HEAD requests return 405, and the optional DASHBOARD_ASSETS binding serves asset paths with /dashboard stripped and cookie/authorization headers removed.
• With no binding, /dashboard/* returns an uncached 503 instead of falling through to marketing.
• A development-only Next.js rewrite proxies /dashboard and /dashboard/* to a Vite origin, restricted to HTTP loopback addresses.

Rollout

• Publish the relay-dashboard static asset Worker, deploy Cloud's /dashboard/ OAuth return support, then enable the DASHBOARD_ASSETS binding.
• Rollback removes the binding; existing /cloud/dashboard/* routing is unaffected.

^{Written for commit ab9ad25. Summary will update on new commits.}

---

Agent Relay sessions

• codex session 01a18eee · opened via gh pr create · last active 2026-10-31

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

Preview deployed!

Environment	URL
Web	https://41f506b2-agentrelay-web.agent-workforce.workers.dev

This is a Cloudflare Workers preview version of this PR's build.

[kjgbot]

Review record — Codex primary reviewer, exact head 4ca656cf84918be30d9f4107662ae3671f953a95.

Reviewed the full current-main composition, router dispatch and service-binding behavior, development rewrite, CI discovery, and rollout documentation. No blocking routing-code finding remains from this pass. The root prefix/query behavior, removal of Cookie/Authorization, missing-binding no-store 503, method restriction with an available binding, and separation from existing /cloud and owner dashboards agree with the intended contract. The production service binding remains disabled.

Fixed the regression-protection gap found by the independent reviewer: the excluded Node .mjs is replaced with 13 Vitest TypeScript cases discovered by normal npm test. On this exact source: 619 web + 123 router tests; both typechecks; lint with no errors/four existing warnings. Negative controls produce 10 failures without the rewrite, 7 without origin validation, and 2 without the development guard; restoring the config byte-for-byte restores all 13 cases.

Not an approval to merge or deploy: production compilation, types, and 252 static pages completed, but npm run build exited 1 because the inherited Next16.4.0 security check fired. Existing #252 supplies the patched version. Current-head CI and the independent final-head review must be read separately. The real Google/provider/shared-origin dashboard journey is still unverified; configured credentials do not establish OAuth completion. Keep draft until those gates and the repository's two recorded reviews are satisfied.

[kjgbot]

Independent agent review record — /root/review_marketing257, exact head 4ca656cf84918be30d9f4107662ae3671f953a95. Posted by the coordinating agent from the independent review artifact; this is not a separate human account or an APPROVED review.

Code-review signoff: no actionable findings. The previous P3 is resolved: the replacement .test.ts is discovered by the web Vitest runner. The independent reviewer ran all 13 proxy cases and the three new router cases with zero failures, verified worktree-local dependency resolution, and checked config/lockfile hashes and negative-control logs (10/7/2 failures). Reviewed current-main privacy/replay behavior and found the new routing branch preserves those contracts.

Evidence limits: this is source/test signoff only. Exact-head CI was still running at review time; the inherited Next16.4.0 security build failure, existing #252 dependency, and real shared-origin OAuth/provider/dashboard journey remain unresolved. No merge, deployment, preview, binding enablement, or production access is approved by this record.