/add-clidash, CLI-derived read-only dashboard

clidash is a small, read-only web dashboard. You point it at any CLI that can list resources as JSON (NanoClaw's ncl, docker, kubectl, …) and it builds the dashboard at runtime: one tab per resource, a generic table over whatever columns the rows have. A new ncl resource becomes a new tab and a new column becomes a new table column with zero code changes.

It ships pre-wired for NanoClaw's ncl CLI and adds three NanoClaw-aware panels driven entirely by config:

• Agents overview, status cards joining groups + sessions + messaging groups + wirings (green <15m / amber <2h / red older).
• Activity, per-session inbound/outbound message totals and a daily series, read directly from the session DBs (ncl has no messages resource).
• Logs, last N lines of allowlisted host log files.
• Files, a read-only viewer for group skills, CLAUDE.md, and profiles.

Why it's safe

clidash is read-only by construction: the server can only execFile the argv templates in its config. {resource} is the sole substitution and is allowlist-validated against the discovered/static resource set before exec, never a shell, no free-form input reaches argv. There is no auth; the network is the auth boundary, it binds 127.0.0.1 by default. Only ever bind a private interface (e.g. a tailnet IP), never a public one.

It's distinct from /add-dashboard (which pushes JSON snapshots to a separate @nanoco/nanoclaw-dashboard npm package): clidash has zero dependencies, no build step, no push pipeline, and no edits to NanoClaw source, it just reads ncl and the session DBs.

Steps

1. Copy the tool into place

clidash is fully self-contained, copy the whole directory in:

tools/ is not a standard NanoClaw directory and cp -R won't create it, so make it first:

mkdir -p tools
cp -R .claude/skills/add-clidash/add/tools/clidash tools/clidash