feat: ship HTTP dashboard and harden daemon/API flows

Add the static HTTP dashboard example and wire in the recent daemon/API polish: CORS-aware API routing, service-install behavior cleanup, safer systemd unit ExecStart quoting, and friendly-name validation for path-safe targeting. Also refresh README/API/roadmap docs, remove the temporary claude observations file, and include the related tests for API/status and daemon validation.
2026-04-18 16:45:12 -04:00
parent 795aa2f713
commit 59fb56558f
17 changed files with 999 additions and 726 deletions
@@ -0,0 +1,46 @@
+# tvctl HTTP API Dashboard Example
+
+This is a static browser dashboard for manual testing of every `tvctl` HTTP API endpoint.
+
+## 1. Enable API + CORS
+
+The API is already enabled by default. CORS is not.
+
+Enable CORS for local browser usage:
+
+```bash
+tvctl config set daemon.cors_enabled true
+tvctl config set daemon.cors_allowed_origins "http://127.0.0.1:8080,http://localhost:8080"
+tvctl config reload
+```
+
+## 2. Serve the dashboard files
+
+From the repository root:
+
+```bash
+python3 -m http.server 8080 -d examples/http-dashboard
+```
+
+Then open:
+
+`http://127.0.0.1:8080`
+
+Do not use the `http://0.0.0.0:8080` URL shown by Python's server output as the browser URL.
+Use `http://127.0.0.1:8080` or `http://localhost:8080` so the request origin matches your
+configured CORS allowlist.
+
+## 3. Test flow
+
+1. `GET /daemon/status`
+2. `GET /devices`
+3. `POST /devices/discover`
+4. Select a target device and test device/apps/remote/dev sections
+5. Use config section for `GET /config`, `PATCH /config`, `POST /config/reload`
+
+## Notes
+
+- Destructive/mutating actions prompt for confirmation.
+- `dev/install` uses multipart upload (`archive` field) as required by the API.
+- Device targets are URL-encoded automatically before calling `/v1/devices/{id}/...` routes.
+- Requests and responses are shown in the response panel for debugging.