add-clidash

# /add-clidash — CLI-derived read-only dashboard clidash is a small, read-only web dashboard. You point it at any CLI that can list resources as JSON (NanoClaw's `ncl`, `docker`, `kubectl`, …) and it builds the dashboard at runtime: one tab per resource, a generic table over whatever columns the rows have. A new `ncl` resource becomes a new tab and a new column becomes a new table column with **zero code changes**. It ships pre-wired for NanoClaw's `ncl` CLI and adds three NanoClaw-aware panels driven entirely by config: - **Agents overview** — status cards joining groups + sessions + messaging groups + wirings (green <15m / amber <2h / red older). - **Activity** — per-session inbound/outbound message totals and a daily series, read directly from the session DBs (`ncl` has no messages resource). - **Logs** — last N lines of allowlisted host log files. - **Files** — a read-only viewer for group skills, `CLAUDE.md`, and profiles. ## Why it's safe clidash is **read-only by construction**: the server can only `execFile` the argv templates in its config. `{resource}` is the sole substitution and is allowlist-validated against the discovered/static resource set before exec — never a shell, no free-form input reaches argv. There is no auth; **the network is the auth boundary** — it binds `127.0.0.1` by default. Only ever bind a private interface (e.g. a tailnet IP), never a public one. It's distinct from `/add-dashboard` (which pushes JSON snapshots to a separate `@nanoco/...