#261 Proxy /dashboard to the dashboard SPA's dev server

In development, the agentrelay.com dev server is the single local gateway for Cloud and the dashboard SPA:

• CLOUD_DEV_ORIGIN rewrites /cloud/* to the local Cloud server.
• DASHBOARD_DEV_ORIGIN rewrites /dashboard to the SPA's entry document (/dashboard/index.html) and /dashboard/* to the relay-dashboard Vite server (base /dashboard/).

Both origins go through one validator, devLoopbackOrigin: the rewrites exist only when NODE_ENV=development, and each origin must be an HTTP loopback origin with no path, credentials, query or fragment. Production builds add no proxy. Next's trailing-slash redirect sends /dashboard/ to /dashboard, which serves the SPA; asset paths such as /dashboard/@vite/client pass through to Vite.

Cloud's npm run dev (AgentWorkforce/cloud, branch feat/dev-launcher-dashboard) sets both origins. AGENTS.md now sends local signup/dashboard/desktop/Flows journeys to that command, which replaces the removed dev:onboarding alias.

Verification

• cd web && npx vitest run: 51 files, 579 passed, 1 skipped. The new lib/test/dev-proxy.test.ts has 7 tests. With the dashboard block removed, 6 of the 7 fail.
• npx tsc --noEmit -p web/tsconfig.json: exit 0.
• npx oxlint web router: exit 0, with only existing warnings in unrelated files.
• I ran Cloud's npm run dev with this checkout as DEV_MARKETING_DIR. Results through http://localhost:3100:
  • GET / returned 200 text/html.
  • GET /cloud/api/v1/auth/whoami returned 401 application/json from Cloud.
  • GET /dashboard/ returned 308 to /dashboard.
  • GET /dashboard returned 200 text/html containing /dashboard/@vite/client and id="root".
  • GET /dashboard/@vite/client returned 200 text/javascript.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Proxies /dashboard to the local dashboard SPA dev server in development, next to the existing /cloud proxy.

Previously only Cloud API calls were proxied via CLOUD_DEV_ORIGIN. Now DASHBOARD_DEV_ORIGIN rewrites /dashboard to the SPA's entry document and /dashboard/* to the relay-dashboard Vite server, so both /dashboard and /dashboard/ open the app and its assets pass through. Both origins share one devLoopbackOrigin validator and exist only when NODE_ENV=development; production builds add no proxy. AGENTS.md now points local signup, dashboard, desktop, and Flows journeys at Cloud's npm run dev, replacing the removed dev:onboarding alias.

• New tests in web/lib/test/dev-proxy.test.ts cover the proxy rules, production absence, and rejection of non-loopback or non-origin targets.

---

Agent Relay sessions

• claude session bea3e5c4 · opened via gh pr create · last active 2026-10-31