kneo-dash

The backend-for-frontend (BFF) for the Kneo Agent Dashboard — the operational console for the Kneo Agent Platform. A thin FastAPI layer over the typed kneo-client SDK: it answers an operator's five questions — what is running, what is stuck, what needs human action, what changed, is production healthy — and serves the dashboard SPA. It never imports kneo-serv and never puts platform API keys in the browser.

This package runs either as the container image ghcr.io/kneo-agent/kneo-dash (BFF + built SPA in one unit) or as the PyPI wheel — the published wheel bundles the built SPA (ADR-011), so pip install kneo-dash && kneo-dash serves the full app (UI + API) same-origin, no container. (A source/editable build without the SPA staged runs API-only.)

Install

pip install kneo-dash

Run

The platform connection comes from the kneo-client profile environment (KNEO_URL + KNEO_API_KEY, or a ~/.config/kneo/client.toml profile):

# Local/trial: KNEO_DASH_DEV_MODE=1 runs a single UNAUTHENTICATED operator (static mode).
# The BFF refuses to start in static mode without it (ADR-009 §5); for a real deployment
# use OIDC instead (KNEO_DASH_AUTH_MODE=oidc + KNEO_DASH_SESSION_SECRET + provider config).
KNEO_URL=https://your-kneo-serv KNEO_API_KEY=… KNEO_DASH_DEV_MODE=1 kneo-dash   # BFF on :8090

Dashboard-server settings use the KNEO_DASH_ env prefix (e.g. KNEO_DASH_AUTH_MODE, KNEO_DASH_SESSION_SECRET, KNEO_DASH_DEFAULT_PROFILE, KNEO_DASH_CORS_ORIGINS, KNEO_DASH_SPA_DIR).

Scope (through 0.6.0)

0.6.0 (current release) added beta-readiness / operability hardening — recovery / break-glass (a restore-detection sentinel), a token-gated /metrics telemetry surface, and server-truth capability gating (/api/me). 0.7.0 (in progress) is a documentation-excellence + a11y cut. Earlier scope, cumulative:

Container-free full install · review-hardening. 0.5.0 bundles the built SPA into the wheel and the sdist (ADR-011), so a bare pip install kneo-dash && kneo-dash serves the full UI + API same-origin with no Docker; it also clears a two-review punch list (workflow deep audit + external review) and lands the frontend majors (React 19 · router 7). Builds on the 0.4.0 auth · RBAC · dashboard config · hardening cut, which itself builds on the 0.2.0 live-debugging core (runs list + detail: status · trace · run-graph · continuation chain · replay/recovery · time-travel diff · live SSE trace tail; run control; the human-in-the-loop queue; Launch Load → Deploy → Run). 0.3.0 wires the governance surfaces — audit (search/paginate), policies (view · preview · update), and the credential-reference inventory (references + scopes; secret values never surfaced) — adds a per-run policy report, session/thread grouping, an operator Overview, HITL bulk resume, 2-run compare, error clusters, recover & continue, and a client-side run-bundle export. It also introduces the dashboard state store (SQLite by default — stdlib; optional Postgres via the [postgres] extra + KNEO_DASH_DB_URL) backing operator annotations, saved Runs filters, and launch history / re-launch. Since 0.4.0 the BFF authenticates operators (OIDC) and enforces roles server-side, with a live Connections env-switcher; run KNEO_DASH_AUTH_MODE=oidc (the unauthenticated static mode is dev-only and refuses to start without KNEO_DASH_DEV_MODE=1).

Links

• Source & docs: https://github.com/kneo-agent/kneo-dash
• License: MIT