khal-os 1.260324.2

package/docs/workos-setup.md

@@ -0,0 +1,116 @@
+# WorkOS Dashboard Setup
+
+Step-by-step guide for configuring WorkOS for Genie OS (Phase 1 — platform scope).
+
+## 1. Create Production Environment
+
+1. Log in to [WorkOS Dashboard](https://dashboard.workos.com)
+2. Navigate to **Environments** and select the **Production** environment
+3. Copy the following credentials to your `.env`:
+   - **API Key** (`WORKOS_API_KEY`): `sk_live_...`
+   - **Client ID** (`WORKOS_CLIENT_ID`): `client_...`
+4. Set `NEXT_PUBLIC_WORKOS_REDIRECT_URI` to your production callback URL:
+   ```
+   https://<prod-domain>/auth/callback
+   ```
+5. Generate a 32+ character random string for `WORKOS_COOKIE_PASSWORD`
+
+## 2. Create NamasteX Organization
+
+1. Go to **Organizations** > **Create Organization**
+2. Name: `NamasteX`
+3. Note the Organization ID (`org_...`) — you'll assign members to this org
+
+## 3. Define Roles
+
+Navigate to **Roles** and create the following roles. These slugs are forward-compatible with Phase 2 multi-org (WorkOS auto-prefixes org roles with `org-`, so platform roles need distinct slugs).
+
+| Role Slug | Description | Assigned To |
+|-----------|-------------|-------------|
+| `platform-owner` | Full platform access — all permissions | NamasteX founders |
+| `platform-admin` | All apps + settings + member management | NamasteX senior team |
+| `platform-dev` | App access for development | NamasteX builders |
+| `member` | Base access (WorkOS default role for new memberships) | All new users |
+
+### Role → Permission Mapping
+
+| Role | Permissions |
+|------|------------|
+| `platform-owner` | `apps:access`, `apps:install`, `settings:manage`, `members:manage`, `billing:manage`, `instances:manage` |
+| `platform-admin` | `apps:access`, `settings:manage`, `members:manage` |
+| `platform-dev` | `apps:access` |
+| `member` | _(no explicit permissions — base access only)_ |
+
+## 4. Define Permissions
+
+Navigate to **Permissions** and create permissions using the `resource:action` pattern:
+
+| Permission Slug | Description | Phase |
+|----------------|-------------|-------|
+| `apps:access` | Base app access | Phase 1 |
+| `apps:install` | Install apps from marketplace | Future (Phase 6) |
+| `settings:manage` | OS settings management | Phase 1 |
+| `members:manage` | Invite/remove organization users | Phase 1 |
+| `billing:manage` | Billing and subscription management | Future (Phase 5) |
+| `instances:manage` | Fleet instance management | Future (Phase 3) |
+
+Assign permissions to roles as shown in the mapping table above.
+
+## 5. Configure Authentication
+
+### Redirect URI
+
+1. Go to **Authentication** > **Redirect URIs**
+2. Add your production callback: `https://<prod-domain>/auth/callback`
+3. Remove any staging URIs if present
+
+### Email Verification
+
+1. Under **Authentication** > **Email Verification**, enable email verification
+2. This ensures users verify their email before accessing the platform
+
+### Session Configuration
+
+1. Under **Authentication** > **Sessions**:
+   - Session lifetime: 7 days (default)
+   - Inactivity timeout: 24 hours (recommended)
+   - Cookie settings are managed by AuthKit SDK via `WORKOS_COOKIE_PASSWORD`
+
+## 6. Configure Webhook
+
+1. Go to **Webhooks** > **Create Endpoint**
+2. Endpoint URL: `https://<prod-domain>/api/webhooks/workos`
+3. Select events to subscribe:
+   - `organization_membership.updated` — role changes
+   - `organization_membership.deleted` — membership revocations
+   - `user.updated` — user metadata changes
+4. Copy the **Signing Secret** to `WORKOS_WEBHOOK_SECRET` in your `.env`
+
+## 7. Assign Members
+
+1. Go to **Organizations** > **NamasteX** > **Members**
+2. Add team members and assign roles:
+   - Founders: `platform-owner`
+   - Senior team: `platform-admin`
+   - Developers: `platform-dev`
+   - New users default to: `member`
+
+## Environment Variables Summary
+
+```env
+WORKOS_API_KEY=sk_live_...
+WORKOS_CLIENT_ID=client_...
+NEXT_PUBLIC_WORKOS_REDIRECT_URI=https://<prod-domain>/auth/callback
+WORKOS_COOKIE_PASSWORD=<32+ char random string>
+WORKOS_WEBHOOK_SECRET=whsec_...
+```
+
+## Phase 1 Scope
+
+This configuration covers the **platform scope** only (NamasteX org, platform roles).
+
+- **Phase 2** will add client organizations with `client-owner`, `client-admin`, `client-member` roles
+- **Phase 3** will add instance fleet management
+- **Phase 4** will add FGA per-app permissions
+- **Phase 5** will enable Admin Portal, SCIM, and Audit Logs
+- **Phase 6** will add the app marketplace

package/ecosystem.config.cjs

@@ -0,0 +1,26 @@
+module.exports = {
+	apps: [
+		{
+			name: 'khal-nats',
+			script: 'nats-server',
+			args: '-c nats.conf',
+			cwd: __dirname,
+			autorestart: true,
+		},
+		{
+			name: 'khal-services',
+			script: 'bun',
+			args: 'run src/lib/service-loader.ts',
+			cwd: __dirname,
+			autorestart: true,
+		},
+		{
+			name: 'khal-ws-bridge',
+			script: 'bun',
+			args: 'run src/lib/ws-server.ts',
+			cwd: __dirname,
+			autorestart: true,
+			env: { WS_BRIDGE_PORT: '4280' },
+		},
+	],
+};

package/instrumentation.ts

@@ -0,0 +1,8 @@
+export async function register() {
+	if (process.env.NEXT_RUNTIME === 'nodejs') {
+		await import('./sentry.server.config');
+	}
+	if (process.env.NEXT_RUNTIME === 'edge') {
+		await import('./sentry.edge.config');
+	}
+}

package/knip.json

@@ -0,0 +1,35 @@
+{
+	"$schema": "https://unpkg.com/knip@5/schema.json",
+	"project": ["src/**/*.{ts,tsx}"],
+	"ignoreDependencies": [
+		"tailwindcss",
+		"@json-render/core",
+		"@json-render/react",
+		"@radix-ui/react-label",
+		"zod",
+		"@types/uuid"
+	],
+	"ignoreBinaries": ["d3k"],
+	"ignoreExportsUsedInFile": true,
+	"paths": {
+		"src/components/ui/*": ["src/components/ui/*"],
+		"src/components/os-primitives/*": ["src/components/os-primitives/*"]
+	},
+	"ignore": [
+		"src/components/ui/command.tsx",
+		"src/components/ui/ContextMenu.tsx",
+		"src/components/ui/dropdown-menu.tsx",
+		"src/components/os-primitives/collapsible-sidebar.tsx",
+		"src/components/os-primitives/list-view.tsx",
+		"src/components/os-primitives/status-badge.tsx",
+		"src/components/os-primitives/toolbar.tsx"
+	],
+	"rules": {
+		"unlisted": "off",
+		"files": "warn",
+		"exports": "warn",
+		"types": "warn",
+		"dependencies": "warn",
+		"devDependencies": "warn"
+	}
+}

package/nats.conf

@@ -0,0 +1,7 @@
+listen: 127.0.0.1:4222
+
+jetstream {
+  store_dir: "./data/nats"
+  max_mem: 256MB
+  max_file: 1GB
+}

package/next.config.ts

@@ -0,0 +1,25 @@
+import { withSentryConfig } from '@sentry/nextjs';
+import type { NextConfig } from 'next';
+
+const nextConfig: NextConfig = {
+	allowedDevOrigins: ['dev.khal.namastex.io'],
+	typescript: {
+		ignoreBuildErrors: true,
+	},
+	images: {
+		dangerouslyAllowSVG: true,
+	},
+	// node-pty is server-only (used by pty-server.mjs, not by Next.js)
+	// but it's in dependencies, so tell webpack to skip it for client bundles
+	serverExternalPackages: ['node-pty', 'archiver'],
+};
+
+export default withSentryConfig(nextConfig, {
+	// Suppresses source map uploading logs during build
+	silent: true,
+	// Upload source maps only when SENTRY_AUTH_TOKEN is set
+	org: process.env.SENTRY_ORG,
+	project: process.env.SENTRY_PROJECT,
+	// Disable telemetry
+	telemetry: false,
+});

package/package.json

@@ -0,0 +1,78 @@
+{
+	"name": "khal-os",
+	"version": "1.260324.2",
+	"scripts": {
+		"dev": "next dev --port 8888",
+		"build": "NEXT_PRIVATE_BUILD_WORKER=false next build",
+		"start": "next start --port 8888",
+		"pty-server": "node pty-server.mjs",
+		"lint": "biome check .",
+		"lint:fix": "biome check --write .",
+		"knip": "knip",
+		"dev:d3k": "d3k",
+		"services": "bun run src/lib/service-loader.ts",
+		"tauri": "cd tauri && cargo run",
+		"tauri:build": "cd tauri && cargo build --release",
+		"prepare": "husky"
+	},
+	"dependencies": {
+		"@genie-os/dev3000-app": "workspace:*",
+		"@genie-os/files-app": "workspace:*",
+		"@genie-os/genie-app": "workspace:*",
+		"@genie-os/nats-viewer-app": "workspace:*",
+		"@genie-os/sdk": "workspace:*",
+		"@genie-os/settings-app": "workspace:*",
+		"@genie-os/terminal-app": "workspace:*",
+		"@genie-os/ui": "workspace:*",
+		"@json-render/core": "^0.7.0",
+		"@json-render/react": "^0.7.0",
+		"@nats-io/jetstream": "^3.3.1",
+		"@nats-io/transport-node": "^3.3.1",
+		"@radix-ui/react-context-menu": "^2.2.16",
+		"@radix-ui/react-dialog": "^1.1.15",
+		"@radix-ui/react-dropdown-menu": "^2.1.16",
+		"@radix-ui/react-label": "^2.1.8",
+		"@radix-ui/react-separator": "^1.1.8",
+		"@radix-ui/react-slot": "^1.2.4",
+		"@radix-ui/react-switch": "^1.2.6",
+		"@radix-ui/react-tooltip": "^1.2.8",
+		"@sentry/nextjs": "^10.39.0",
+		"@sinclair/typebox": "^0.34.48",
+		"@tauri-apps/api": "^2.10.1",
+		"@types/archiver": "^7.0.0",
+		"@workos-inc/authkit-nextjs": "^2.14.0",
+		"@xterm/addon-fit": "^0.11.0",
+		"@xterm/addon-webgl": "^0.19.0",
+		"@xterm/xterm": "^6.0.0",
+		"archiver": "^7.0.1",
+		"class-variance-authority": "^0.7.1",
+		"clsx": "^2.1.1",
+		"cmdk": "^1.1.1",
+		"iron-session": "^8.0.4",
+		"jose": "^6.1.3",
+		"lucide-react": "^0.563.0",
+		"next": "16.1.6",
+		"next-themes": "^0.4.6",
+		"node-pty": "^1.1.0",
+		"react": "19.2.3",
+		"react-dom": "19.2.3",
+		"tailwind-merge": "^3.4.0",
+		"uuid": "^13.0.0",
+		"zod": "^4.3.6",
+		"zustand": "^5.0.11"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "^2.4.2",
+		"@tailwindcss/postcss": "^4",
+		"@types/node": "^20",
+		"@types/react": "^19",
+		"@types/react-dom": "^19",
+		"@types/uuid": "^11.0.0",
+		"husky": "^9.1.7",
+		"knip": "^5.85.0",
+		"tailwindcss": "^4",
+		"tsx": "^4.21.0",
+		"typescript": "^5"
+	},
+	"packageManager": "pnpm@10.28.2+sha512.41872f037ad22f7348e3b1debbaf7e867cfd448f2726d9cf74c08f19507c31d2c8e7a11525b983febc2df640b5438dee6023ebb1f84ed43cc2d654d2bc326264"
+}

package/packages/dev3000-app/components.ts

@@ -0,0 +1,12 @@
+'use client';
+
+import { type ComponentType, lazy } from 'react';
+
+interface AppComponentProps {
+	windowId: string;
+	meta?: Record<string, unknown>;
+}
+
+export const components: Record<string, ComponentType<AppComponentProps>> = {
+	dev3000: lazy(() => import('./views/dev3000/Dev3000App').then((m) => ({ default: m.Dev3000App }))),
+};

package/packages/dev3000-app/manifest.ts

@@ -0,0 +1,19 @@
+export default {
+	id: 'dev3000-app',
+	views: [
+		{
+			id: 'dev3000',
+			label: 'dev3000',
+			permission: 'dev3000',
+			minRole: 'platform-dev' as const,
+			natsPrefix: 'dev3000',
+			defaultSize: { width: 960, height: 640 },
+			component: './views/dev3000/Dev3000App',
+		},
+	],
+	desktop: {
+		icon: '/icons/dusk/dashboard.svg',
+		categories: ['Development'],
+		comment: 'dev3000 unified development logs',
+	},
+};

package/packages/dev3000-app/package.json

@@ -0,0 +1,23 @@
+{
+	"name": "@genie-os/dev3000-app",
+	"version": "0.0.1",
+	"private": true,
+	"main": "./manifest.ts",
+	"exports": {
+		".": "./manifest.ts",
+		"./components": "./components.ts",
+		"./views/*": "./views/*"
+	},
+	"genieOs": {
+		"services": [
+			{
+				"name": "dev3000",
+				"entry": "./views/dev3000/service/index.ts",
+				"runtime": "node"
+			}
+		]
+	},
+	"peerDependencies": {
+		"react": ">=19"
+	}
+}