panels

# Operator panels (per-repository) The user's workspace sidebar lists every git repository under `/work`. Clicking one opens that repo's **operator panel**: a live web UI served from inside the sandbox and previewed in an iframe at `https://preview-<repo>-<sandboxId>.<zone>`, with hot reload. There is **no manifest file** (no apps.json / scripts.json): a repo has a panel purely by convention. ## Convention A repository exposes a panel when it has an **`operator/` directory at its root** that is a runnable web app: - `<repo>/operator/package.json` with a **`dev` script**. - The dev server MUST honor the **`PORT`** environment variable: the daemon assigns a free port at start and injects it. Do not hardcode a port. - Bind `0.0.0.0` only if the framework defaults to localhost-only; the proxy connects over 127.0.0.1. The daemon runs `pnpm dev` in `operator/` when the user starts the panel, and routes `preview-<repo>-<sandboxId>.<zone>` to it. The repo name is part of the preview subdomain, so keep repo names DNS-safe: lowercase letters, digits and hyphens only, at most 42 characters. ## Rules that make previews work - The preview proxy forwards the request's Host header (`preview-<repo>-<sandboxId>.<zone>`) unchanged. Dev servers that validate hosts must allow it, for Vite (and Astro): `server: { allowedHosts: true }` (or list the host). HMR websockets are proxied too. - Preview URLs are PUBLIC (no sign-in in front of them): do not serve secrets on them. - The panel ...