fix: land topic brief parity and dompurify hardening (#140)

* fix: land topic brief parity and dompurify hardening

* chore: align react and vite dependency maintenance

* fix: align topic brief provider defaults

* fix: tighten front door and operator UI surfaces

* fix: bump basic-ftp override to patched release

Author: xiaojiou176

CHANGELOG.md

@@ -20,7 +20,7 @@ All notable changes to this repository will be documented in this file.
   of leaving those pages on scattered inspector phrasing
 - pinned transitive dashboard security fixes through the maintained pnpm
   override surfaces so `axios` now resolves to `1.15.0` and `basic-ftp` to
-  `5.2.2` in both the root and dashboard lockfiles, clearing the live
+  `5.3.0` in both the root and dashboard lockfiles, clearing the live
   Dependabot alert chain without widening into unrelated dependency upgrades
 - added a registry-shaped `manifest.yaml` for the repo-owned
   `openvibecoding-adoption-router` skill inside the coding-agent bundle, then

README.md

@@ -103,9 +103,9 @@ A clean first pass should let you:
 
 For the public product story, the current official first proven workflow is
 [`news_digest`](https://xiaojiou176-open.github.io/OpenVibeCoding/use-cases/).
-`topic_brief` remains a public showcase and discovery lane, and it still does
-not belong to the repo-tracked public proof bundle until it has its own
-dedicated healthy proof summary, benchmark summary, and share-ready recap.
+`topic_brief` now has a tracked search-backed public proof bundle, but it is
+still not the official first public baseline and should not be described as
+equally release-proven with `news_digest`.
 `page_brief` now has a tracked browser-backed public proof bundle, but it is
 still not the official first public baseline and should not be described as
 equally release-proven with `news_digest`.
@@ -332,13 +332,13 @@ The current dashboard front door now surfaces all three public cases, while
 | Public case | Best for | Example input | Proof state |
 | --- | --- | --- | --- |
 | `news_digest` | the fastest proof-oriented public first run | one topic + 3 public domains + `24h` | **official first public baseline** |
-| `topic_brief` | a narrow topic brief with search-backed evidence | one topic + `7d` + max results | public showcase / discovery lane, not yet equally release-proven |
+| `topic_brief` | a narrow topic brief with search-backed evidence | one topic + `7d` + max results | tracked search-backed public proof bundle |
 | `page_brief` | one URL with browser-backed evidence | one URL + one focused summary request | tracked browser-backed public proof bundle |
 
 For the first public release bundle, `news_digest` is the only official
-proof-oriented first-run baseline. `topic_brief` remains part of the broader
-public surface as a showcase / discovery path, and it still lacks its own
-dedicated healthy proof summary, benchmark summary, and share-ready recap.
+proof-oriented first-run baseline. `topic_brief` now has its own tracked
+search-backed public proof bundle, but it still should not be described as the
+official first baseline or as equally release-proven with `news_digest`.
 `page_brief` now has its own tracked browser-backed public proof bundle, but it
 still should not be described as the official first baseline or as equally
 release-proven with `news_digest`.

apps/dashboard/app/globals.feature.part04.css

@@ -170,59 +170,13 @@
   display: block;
 }
 
-.home-briefing-directive {
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius-lg);
-  background:
-    linear-gradient(180deg, color-mix(in srgb, var(--color-bg-elevated) 98%, white), transparent),
-    var(--color-surface-subtle);
-  padding: var(--space-4) var(--space-5);
-  display: grid;
-  gap: var(--space-2);
-  grid-template-columns: repeat(3, minmax(0, 1fr));
-}
-
-.home-briefing-directive p,
 .planner-priority-summary,
 .compare-verdict-summary {
   color: color-mix(in srgb, var(--color-text-primary) 80%, var(--color-text-secondary));
   font-size: var(--text-sm);
   line-height: 1.6;
 }
 
-.home-dispatch-item {
-  display: grid;
-  gap: var(--space-1);
-  padding-left: var(--space-3);
-  border-left: 1px solid color-mix(in srgb, var(--color-primary) 14%, var(--color-border));
-}
-
-.home-dispatch-item:first-child {
-  padding-left: 0;
-  border-left: 0;
-}
-
-.home-dispatch-kicker {
-  font-family: var(--font-mono);
-  font-size: var(--text-kicker);
-  color: var(--color-text-muted);
-  letter-spacing: 0.06em;
-  text-transform: uppercase;
-}
-
-.home-dispatch-title {
-  font-size: 16px;
-  line-height: 1.25;
-  letter-spacing: -0.02em;
-}
-
-.home-dispatch-desc {
-  margin: 0;
-  color: color-mix(in srgb, var(--color-text-primary) 74%, var(--color-text-secondary));
-  font-size: 12px;
-  line-height: 1.6;
-}
-
 .home-briefing-actions,
 .planner-primary-actions {
   display: flex;
@@ -951,28 +905,12 @@
     grid-template-columns: 1fr;
   }
 
-  .home-briefing-directive {
-    grid-template-columns: 1fr;
-  }
-
   .home-briefing-meter-row,
   .home-command-grid,
   .quick-grid--triage-spotlight {
     grid-template-columns: 1fr;
   }
 
-  .home-dispatch-item {
-    padding-left: 0;
-    border-left: 0;
-    padding-top: var(--space-2);
-    border-top: 1px solid color-mix(in srgb, var(--color-primary) 14%, var(--color-border));
-  }
-
-  .home-dispatch-item:first-child {
-    padding-top: 0;
-    border-top: 0;
-  }
-
   .home-command-grid,
   .planner-empty-grid,
   .home-loop-rail {

apps/dashboard/app/globals.layout.part01.css

@@ -647,7 +647,7 @@
 }
 
 .run-link {
-  color: var(--color-primary);
+  color: var(--color-success-ink);
   font-weight: 600;
   font-family: "SF Mono", "JetBrains Mono", ui-monospace, monospace;
   font-size: var(--text-sm);

apps/dashboard/components/DashboardHomeStorySections.tsx

@@ -329,59 +329,6 @@ export default function DashboardHomeStorySections({
             detail: hasRunHistory ? "The homepage routes you; it does not replace proof." : "Write the request first, then let the truth rooms light up.",
           },
         ];
-  const dispatchBrief =
-    locale === "zh-CN"
-      ? [
-          {
-            kicker: "现在发生什么",
-            title: hasRunHistory ? `${runningCount} 条运行在推进` : "系统还在等待第一条运行",
-            desc: hasRunHistory
-              ? "先读 tower，再决定是不是要切到 Workflow Case 或证明室。"
-              : "先用第一条任务把 command loop 真的跑起来。",
-          },
-          {
-            kicker: "先去哪一桌",
-            title: failedCount > 0 ? "先去指挥塔或失败事件" : hasRunHistory ? "先去指挥塔" : "先去 PM 入口",
-            desc: failedCount > 0
-              ? "先分诊高风险线，再考虑继续派发。"
-              : hasRunHistory
-                ? "首页不是路由墙。先从主驾驶舱看全局。"
-                : "先写请求，再让系统自己把后续房间点亮。",
-          },
-          {
-            kicker: "为什么可信",
-            title: hasRunHistory ? "Workflow + Proof 才算真相" : "先跑出第一条证据链",
-            desc: hasRunHistory
-              ? "不要只看漂亮的首页卡片。真正可托底的是 Workflow Case 和 Proof & Replay。"
-              : "没有第一条任务，就没有值得相信的 tower / workflow / proof 节奏。",
-          },
-        ]
-      : [
-          {
-            kicker: "What is live now",
-            title: hasRunHistory ? `${runningCount} runs are moving` : "The system is still waiting for the first run",
-            desc: hasRunHistory
-              ? "Read the tower first, then decide whether to branch into Workflow Cases or Proof."
-              : "Run one real task so the command loop becomes a live system instead of a promise.",
-          },
-          {
-            kicker: "Where to go first",
-            title: failedCount > 0 ? "Start in Command Tower or Events" : hasRunHistory ? "Start in Command Tower" : "Start in PM intake",
-            desc: failedCount > 0
-              ? "Triage the risky lane before you queue or promote anything else."
-              : hasRunHistory
-                ? "This home page should not behave like a route wall. Start from the cockpit."
-                : "Write the request first, then let the rest of the system light up around it.",
-          },
-          {
-            kicker: "Why this is trustworthy",
-            title: hasRunHistory ? "Workflow plus Proof is the truth path" : "Earn the first proof chain",
-            desc: hasRunHistory
-              ? "Do not trust the homepage alone. Workflow Cases and Proof & Replay are where the operator truth actually hardens."
-              : "Without one real task, the tower, workflow, and proof rooms are still only a shell.",
-          },
-        ];
-
   return (
     <>
       <header className="app-section">
@@ -404,15 +351,6 @@ export default function DashboardHomeStorySections({
                 ? "首页第一屏先回答四件事：你现在在哪、系统正在发生什么、哪里堵住了、下一步该进哪条操作路径。"
                 : "The first screen should answer four questions immediately: where you are, what is happening now, what is blocked, and which surface to open next."}
             </p>
-            <div className="home-briefing-directive" aria-label={locale === "zh-CN" ? "首页 dispatch brief" : "Homepage dispatch brief"}>
-              {dispatchBrief.map((item) => (
-                <div key={item.kicker} className="home-dispatch-item">
-                  <span className="home-dispatch-kicker">{item.kicker}</span>
-                  <strong className="home-dispatch-title">{item.title}</strong>
-                  <p className="home-dispatch-desc">{item.desc}</p>
-                </div>
-              ))}
-            </div>
             <nav aria-label="Home primary actions" className="home-briefing-actions">
               <Button asChild variant="default">
                 <Link href={primaryActionHref} prefetch>{shellCopy.primaryAction}</Link>

apps/dashboard/package.json

@@ -21,12 +21,12 @@
     "axe-core": "4.11.1",
     "class-variance-authority": "0.7.1",
     "diff2html": "3.4.56",
-    "dompurify": "3.3.3",
+    "dompurify": "3.4.0",
     "is-wsl": "2.2.0",
     "next": "16.2.3",
     "playwright": "1.59.1",
-    "react": "19.2.4",
-    "react-dom": "19.2.4",
+    "react": "19.2.5",
+    "react-dom": "19.2.5",
     "styled-jsx": "5.1.7"
   },
   "devDependencies": {
@@ -45,7 +45,7 @@
   "pnpm": {
     "overrides": {
       "axios": "1.15.0",
-      "basic-ftp": "5.2.2",
+      "basic-ftp": "5.3.0",
       "brace-expansion@5": "5.0.5",
       "follow-redirects": "1.16.0",
       "lodash-es": "4.18.1",
@@ -55,7 +55,7 @@
       "picomatch@2": "2.3.2",
       "picomatch@4": "4.0.4",
       "rollup": "4.59.0",
-      "vite": "8.0.5"
+      "vite": "8.0.7"
     }
   }
 }