Skip to main content

Source: docs/manual/ui.md

This page is generated by site/scripts/sync-manual-docs.mjs.

Web UI

Cruvero's web UI is served by cmd/ui and provides the runtime control plane for runs, supervisor orchestration, Knowledge Bases, agents, MCP, governance, and tenant operations.

Source: cmd/ui/main.go, cmd/ui/runtime_routes.go, cmd/ui/frontend/*

Start​

go run ./cmd/ui --addr :8080

Open http://localhost:8080.

UI Modes​

  • CRUVERO_UI_MODE=react (default): React SPA served by the Go binary.
  • CRUVERO_UI_MODE=htmx: legacy server-rendered mode retained for compatibility.

Current Control Plane Scope​

  • Run lifecycle: create runs, replay, approve, answer, inspect, explain, failure analysis.
  • Supervisor orchestration: multi-agent start, preflight preview, run preview simulation, feature ripple scoring.
  • Knowledge Bases: create/update/delete KBs, upload documents, trigger embeddings, bind KBs to prompt registry versions.
  • Run templates: persist and reuse launch form states for single-agent and supervisor runs.
  • Agent administration: create agents, inspect capability/trust status, create agent versions, track MCP liveness bindings.
  • Governance: audit, security, immune, quota, PII, model approvals/preferences.
  • Platform operations: health, dashboards, queues/workers, events, tenant and user management.

Route Inventory​

  • React route definitions: cmd/ui/frontend/src/App.tsx
  • Current route surface: 54 routes (including auth, aliases, and catch-all).
  • Detailed page inventory and role gates: React Web UI and UI Page Guide.

Runtime API Surface (Key Endpoints)​

Authoritative registrations live in cmd/ui/main.go and cmd/ui/runtime_routes.go.

Runs and Supervisor​

  • GET /api/runs
  • GET /api/run
  • GET /api/stream
  • POST /api/execute
  • POST /api/replay
  • POST /api/approve
  • POST /api/answer
  • POST /api/runs/{id}/feedback
  • POST /api/runs/{id}/analyze-failure
  • GET /api/runs/{id}/explain
  • POST /api/supervisor/start
  • POST /api/supervisor/preflight-preview
  • POST /api/supervisor/preview-run
  • POST /api/supervisor/feature-ripple
  • GET /api/supervisor/run
  • GET /api/supervisor/blackboard
  • POST /api/supervisor/signal

Knowledge Bases and Templates​

  • GET|POST /api/knowledge-bases
  • GET|PUT|DELETE /api/knowledge-bases/{id}
  • POST /api/knowledge-bases/{id}/upload
  • POST /api/knowledge-bases/{id}/embed
  • GET|POST /api/run-templates
  • GET /api/run-templates/{id}

Flows, MCP, and Admin​

  • GET|POST /api/flows
  • POST /api/flows/{name}/validate
  • POST /api/flows/{name}/preview
  • POST /api/flows/{name}/deploy
  • GET|POST /api/mcp/servers
  • GET /api/mcp/tools
  • GET /api/mcpgw/gateways
  • GET|PUT /api/tenant/settings
  • GET /api/tenant/users
  • GET|PUT /api/settings/overrides
  • GET|PUT /api/tool-settings

Core Ops and Governance​

  • GET /api/dashboard/summary
  • GET /api/events/*
  • GET /api/audit*
  • GET /api/security/alerts
  • GET|PUT /api/pii/policy
  • GET /api/quota
  • POST /api/quota/reset
  • POST /api/quota/override
  • GET /api/health
  • GET /api/health/detail
  • GET /api/health/metrics

Security Notes​

  • Runtime API role checks are enforced server-side.
  • Mutating runtime endpoints use CSRF protection.
  • Optional admin token protection still applies to quota mutation and immune release endpoints (CRUVERO_UI_ADMIN_TOKEN).
  • Deploy behind SSO (OIDC/Keycloak) for shared environments.