Skip to main content
The dashboard is a Next.js app that reads and drives a running kernel over the HTTP API. It lives in its own repository, rebuno/dashboard.

​
Pages

​
Sessions and subagent trees

View tree on an execution shows the session it belongs to: each turn in order, the subagents it started beneath it, and any session that branched from it.

​
Reaching the kernel

The browser never calls the kernel. Every request goes to the dashboard’s own /api/v0/* route, which forwards it to REBUNO_URL. Without sign-in, it attaches Authorization: Bearer $REBUNO_API_KEY. No token ever reaches the browser.
Without sign-in, anyone who can reach the dashboard gets the access of REBUNO_API_KEY. Turn on sign-in or put the dashboard behind your own authentication before exposing it.

​
Sign-in

Set OIDC_ISSUER and the dashboard signs users in with your identity provider and calls the kernel as each of them. Register the dashboard as a web application with the redirect URI <DASHBOARD_URL>/auth/callback and the post-logout redirect URI <DASHBOARD_URL>/:
The dashboard forwards the user’s ID token, so set the kernel’s REBUNO_OIDC_AUDIENCE to the dashboard’s client ID. See OIDC. Executions the user creates record them in created_by, their approvals record them in decided_by, and access roles limit what they see. REBUNO_API_KEY is not sent with their requests. With OIDC_FORWARD_TOKEN=access, the dashboard forwards the access token instead, for providers that issue JWT access tokens with an audience the kernel accepts. Tokens are kept in an encrypted, httpOnly cookie and refreshed before they expire when the provider issues a refresh token. Without one, the user signs in again when the token expires. Every replica needs the same SESSION_SECRET. The kernel reads the user’s groups from the token, so add the scope your provider needs to include them, such as groups for Okta.

​
Metrics

Set PROMETHEUS_URL and the metrics page queries Prometheus over a time range you pick on the page. With it unset the page scrapes the kernel’s /metrics endpoint instead. Those are one process’s in-memory counters. They are cumulative since that replica started, so no time range applies. Across replicas you see whichever one answered. The page labels which source it used. With sign-in, every signed-in user sees metrics for the whole deployment. Point a real Prometheus at the kernel for anything beyond local development.

​
Configuration

​
Running it

Needs Node 20.9 or later and a kernel to talk to. rebuno dev is enough for local work. It runs with auth disabled, so it needs no REBUNO_API_KEY.

​
Docker

The image is built from deploy/Dockerfile and published to ghcr.io/rebuno/dashboard on tagged releases. It serves a standalone Next.js build on port 3000: