feat(home): new home layout with SVG assets, tile board, and per-route panel state

[rafavalls]

What is this contribution about?

Redesigns the home page with a new tile board system, SVG decorative assets (replacing PNGs, with light/dark variants), and a per-route tasks panel state. The tasks panel now defaults open on home (wide 560 px) and independently tracks open/close state from the chat routes. Preset cards in the tasks panel get a bordered style with numbered step badges to guide users through the brand → landing → monitoring flow. Tile icons are replaced by IntegrationIcon sourced from WELL_KNOWN_AGENT_TEMPLATES, and three new templates (brand-context, landing-page, system-health) are registered there.

Screenshots/Demonstration

UI changes affect the home page layout, sidebar width, preset card thumbnails, tile icons, and background decorations. Screenshots should show light + dark mode.

How to Test

1. Run bun run dev and navigate to the home route.
2. Verify the background corner SVGs render in light and dark mode.
3. Open the tasks panel — it should be wide (560 px) and default to preset cards.
4. Click "Extract brand context" — a tile should be pinned to the board and the chat should open.
5. Navigate to a chat task route; the panel should switch to the task list at normal width (340 px).
6. Toggle the panel closed on home, navigate to chat and back — the home panel should remember its closed state.

Migration Notes

No database migrations required. Old PNG assets under public/home/ are deleted; new SVGs replace them.

Review Checklist

• PR title is clear and descriptive
• Changes are tested and working
• Documentation is updated (if needed)
• No breaking changes

---

Summary by cubic

Redesigned the Home page with a server‑backed 3‑column tile board and a preset tasks system that auto‑pins tiles when started. Added onboarding agents and tools (brand context, system health, and web developer) with improved install flows and inline HTML previews.

• New Features

  • Home tile board: drag/resize/remove; per‑user/per‑org state in KV via /api/:org/home-board; tiles auto‑pin on POST /preset-tasks/:id/start; icons use IntegrationIcon.
  • Preset tasks: backend registry at /preset-tasks lists five cards (New chat, Extract brand context, Create landing page, Set up error monitoring, Import Deco); /start seeds a thread and returns taskId; DBOS workflow tracks brand‑context completion; shared install dialogs and OAuth handshake for GitHub and System Health.
  • Agents:
    • brand-context: setup and confirm modes with built‑in tools (brand_context_setup, update_brand_context, reextract_brand_context, confirm_brand).
    • system-health: idempotent install; new automation tools to create health checks (schedule/subscribe) and manage triggers.
    • web-developer: built‑in tools (write_html_page, read_html_page, list_html_pages, delete_html_page); chat shows inline HTML previews.
  • Tasks panel: per‑route open/close; defaults open and 560 px wide on Home (340 px in chat).
  • Background/UI: SVG corner assets (light/dark), fixed while content scrolls; chat input dark‑mode background set to bg-card.
  • Visibility: lightweight probes for Deco sites and GitHub installation to gate card visibility without failing the page.

• Bug Fixes

  • Brand‑context: sanitize long/dirty fields in prompts, clearer errors when extraction fails, and guards to ensure a brand exists before confirm mode.

• Migration

  • Assets: PNGs under public/home/ replaced with SVGs.
  • Persistence: Home board now uses server‑side storage (KV). No action needed.

^{Written for commit b505e81. Summary will update on new commits.}

[github-actions]

🧪 Benchmark

Should we run the Virtual MCP strategy benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[github-actions]

Release Options

Suggested: Minor (2.327.0) — based on feat: prefix

React with an emoji to override the release type:

Reaction	Type	Next Version
👍	Prerelease	2.326.4-alpha.1
🎉	Patch	2.326.4
❤️	Minor	2.327.0
🚀	Major	3.0.0

Current version: 2.326.3

Note: If multiple reactions exist, the smallest bump wins. If no reactions, the suggested bump is used (default: patch).

[cubic-dev-ai]

16 issues found across 63 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/mesh/src/agents/system-health.ts">

<violation number="1" location="apps/mesh/src/agents/system-health.ts:76">
P2: `ensureSystemHealthConnection` is not truly idempotent under concurrent calls; the check-then-create sequence can create duplicate system-health connections for one organization.</violation>
</file>

<file name="apps/mesh/src/web/components/home/tiles/tile-error-boundary.tsx">

<violation number="1" location="apps/mesh/src/web/components/home/tiles/tile-error-boundary.tsx:24">
P2: This error boundary never resets after a crash, so a tile can remain permanently stuck on the fallback until remount. Add a reset mechanism (for example, reset when a `resetKey` prop changes).</violation>
</file>

<file name="apps/mesh/src/agents/dynamic-instructions.ts">

<violation number="1" location="apps/mesh/src/agents/dynamic-instructions.ts:33">
P2: Use an explicit null check when resolving instructions; the current truthy check incorrectly ignores valid empty-string results.</violation>
</file>

<file name="apps/mesh/src/storage/home-board.ts">

<violation number="1" location="apps/mesh/src/storage/home-board.ts:123">
P1: `pickAutoPinSlot` has a hardcoded row cap and may return an unchecked occupied position once `y` reaches 1024.</violation>
</file>

<file name="apps/mesh/src/web/lib/query-keys.ts">

<violation number="1" location="apps/mesh/src/web/lib/query-keys.ts:89">
P2: `homeBoard` query key is missing a user dimension even though the cached data is per-user, which can cause cross-user cache reuse within the same org.</violation>
</file>

<file name="apps/mesh/src/tools/github/has-installation.ts">

<violation number="1" location="apps/mesh/src/tools/github/has-installation.ts:51">
P2: This check only inspects the first page of GitHub installations, so it can incorrectly return `false` when the matching org appears on later pages.</violation>
</file>

<file name="apps/mesh/src/web/hooks/use-auto-install-system-health.ts">

<violation number="1" location="apps/mesh/src/web/hooks/use-auto-install-system-health.ts:60">
P1: The start condition can permanently block auto-install when `org` is not ready on first render. Include `org` in the gate before setting `startedRef`.</violation>
</file>

<file name="apps/mesh/src/web/hooks/use-tasks-panel-state.tsx">

<violation number="1" location="apps/mesh/src/web/hooks/use-tasks-panel-state.tsx:34">
P2: `chatOpen` is derived from `tasks.length` only at initial mount, so route transitions after task-list changes can show the chat panel closed even when open tasks exist.</violation>
</file>

<file name="apps/mesh/src/api/routes/deco-sites.ts">

<violation number="1" location="apps/mesh/src/api/routes/deco-sites.ts:462">
P0: Hardcoded deco.cx email bypasses per-user identity and makes authorization/data lookups run as a fixed account.</violation>
</file>

<file name="apps/mesh/src/api/routes/decopilot/built-in-tools/brand-context-confirm.ts">

<violation number="1" location="apps/mesh/src/api/routes/decopilot/built-in-tools/brand-context-confirm.ts:140">
P1: Handle `extractBrandFromDomain` exceptions and return a structured tool error instead of letting the tool throw.</violation>

<violation number="2" location="apps/mesh/src/api/routes/decopilot/built-in-tools/brand-context-confirm.ts:195">
P2: Verify the organization still has a primary brand before marking the brand-context preset as completed.</violation>
</file>

<file name="apps/mesh/src/preset-tasks/brand-context-workflow.ts">

<violation number="1" location="apps/mesh/src/preset-tasks/brand-context-workflow.ts:74">
P2: Guard timeout/error writes so only the active workflow run can update preset state; otherwise stale workflows can overwrite newer run results.</violation>
</file>

<file name="apps/mesh/src/agents/brand-context.ts">

<violation number="1" location="apps/mesh/src/agents/brand-context.ts:54">
P1: Untrusted brand fields are injected into the system prompt without sanitization, enabling prompt-injection via extracted website content.</violation>
</file>

<file name="apps/mesh/src/api/routes/preset-tasks.ts">

<violation number="1" location="apps/mesh/src/api/routes/preset-tasks.ts:272">
P1: Require authentication on the dismiss route; it currently allows unauthenticated callers to modify org-scoped preset task state.</violation>
</file>

<file name="apps/mesh/src/api/app.ts">

<violation number="1" location="apps/mesh/src/api/app.ts:437">
P2: Token persistence misses client credentials sent via HTTP Basic auth, which causes stored tokens to be non-refreshable (`clientId` remains null).</violation>

<violation number="2" location="apps/mesh/src/api/app.ts:539">
P1: Persisting downstream tokens in the shared oauth-proxy handler allows token writes on the legacy unscoped path, which can bypass org-scoped authorization checks.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: chatOpen is derived from tasks.length only at initial mount, so route transitions after task-list changes can show the chat panel closed even when open tasks exist.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/mesh/src/web/hooks/use-tasks-panel-state.tsx, line 34:

<comment>`chatOpen` is derived from `tasks.length` only at initial mount, so route transitions after task-list changes can show the chat panel closed even when open tasks exist.</comment>

<file context>
@@ -12,27 +12,32 @@ interface TasksPanelState {
+  const [homeOpen, setHomeOpen] = useState<boolean>(() =>
+    onHome ? resolveTasksOpen(search.tasks, true) : true,
   );
+  const [chatOpen, setChatOpen] = useState<boolean>(() =>
+    !onHome
+      ? resolveTasksOpen(search.tasks, tasks.length > 0)
</file context>

[cubic-dev-ai]

1 issue found across 16 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/mesh/src/api/routes/decopilot/built-in-tools/web-developer.ts">

<violation number="1" location="apps/mesh/src/api/routes/decopilot/built-in-tools/web-developer.ts:159">
P2: `list_html_pages` only returns the first 100 objects, so results become incomplete once a thread has >100 pages.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 6 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/mesh/src/agents/brand-context.ts">

<violation number="1" location="apps/mesh/src/agents/brand-context.ts:50">
P1: `sanitizeBrandField` does not neutralize `<`/`>`, so untrusted brand content can inject `</brand>` and escape the protected block in the prompt. Escape angle brackets (and `&`) before interpolation.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.}

[cubic-dev-ai]

1 issue found across 32 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/mesh/src/web/hooks/use-oauth-handshake.ts">

<violation number="1" location="apps/mesh/src/web/hooks/use-oauth-handshake.ts:87">
P2: `onPersistFallback` can run twice when the first fallback call throws, causing duplicate side effects.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.}

[cubic-dev-ai]

P2: onPersistFallback can run twice when the first fallback call throws, causing duplicate side effects.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/mesh/src/web/hooks/use-oauth-handshake.ts, line 87:

<comment>`onPersistFallback` can run twice when the first fallback call throws, causing duplicate side effects.</comment>

<file context>
@@ -0,0 +1,108 @@
+      );
+      if (!response.ok) {
+        if (opts.onPersistFallback) {
+          await opts.onPersistFallback(connectionId, token);
+        } else {
+          const body = (await response.json().catch(() => ({}))) as {
</file context>

_{Tip: Review your code locally with the cubic CLI to iterate faster.}