feat(frontend): bake Fabric-purple Hangman Lab logo as brand asset

public/brand-logo.svg = ~/hangman-lab-logo-black.svg recolored #000000 -> #9333ea (Fabric deep purple). Dockerfile writes .env.production at build (context .env* is dockerignored) so VITE_APP_NAME/LOGO_URL/FAVICON_URL bake in; logo+favicon -> the mark. Overridable via build args. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
feat(frontend): OIDC login + runtime env (FABRIC_OIDC_ONLY/FIX_TO_CENTER)
2026-05-18 10:02:14 +01:00 · 2026-05-18 09:44:49 +01:00 · 2026-05-18 09:18:21 +01:00 · 2026-05-16 16:15:02 +01:00 · 2026-05-16 12:53:24 +01:00 · 2026-05-16 12:11:34 +01:00
25 changed files with 815 additions and 161 deletions
--- a/.env.example
+++ b/.env.example
@@ -2,3 +2,8 @@ VITE_CENTER_API_BASE=http://localhost:7001/api
 VITE_GUILD_API_BASE=http://localhost:7002/api
 VITE_GUILD_SOCKET_BASE=http://localhost:7002/realtime
 VITE_API_KEY=change-me-api-key
+
+# Brand overrides (build-time only; baked at build). Leave empty for Fabric defaults.
+VITE_APP_NAME=Fabric
+VITE_LOGO_URL=
+VITE_FAVICON_URL=
--- a/.gitignore
+++ b/.gitignore
@@ -22,3 +22,4 @@ dist-ssr
 *.njsproj
 *.sln
 *.sw?
+dist-desktop
--- a/17
+++ b/17
@@ -5,11 +5,28 @@ COPY package*.json ./
 RUN npm ci

 COPY . .
+
+# Brand is baked at build (Vite VITE_* are build-time). Written here, not
+# via a context .env (.dockerignore excludes .env*). public/brand-logo.svg
+# ships the Fabric-purple Hangman Lab mark; override args if rebranding.
+ARG VITE_APP_NAME=Fabric
+ARG VITE_LOGO_URL=/brand-logo.svg
+ARG VITE_FAVICON_URL=/brand-logo.svg
+RUN printf 'VITE_APP_NAME=%s\nVITE_LOGO_URL=%s\nVITE_FAVICON_URL=%s\n' \
+      "$VITE_APP_NAME" "$VITE_LOGO_URL" "$VITE_FAVICON_URL" > .env.production
 RUN npm run build

 FROM nginx:1.27-alpine AS runtime
 COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY docker/entrypoint.sh /docker-entrypoint-fabric.sh
 COPY --from=build /app/dist /usr/share/nginx/html
+RUN chmod +x /docker-entrypoint-fabric.sh
+
+# Runtime SPA config (see docker/entrypoint.sh). Override at `docker run`
+# / compose: empty values keep prior behavior.
+ENV FABRIC_OIDC_ONLY=""
+ENV FIX_TO_CENTER=""

 EXPOSE 80
+ENTRYPOINT ["/docker-entrypoint-fabric.sh"]
 CMD ["nginx", "-g", "daemon off;"]
--- a/README.md
+++ b/README.md
@@ -1,73 +1,61 @@
-# React + TypeScript + Vite
+# Fabric.Frontend

-This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
+The Fabric **web client** — React 19 + TypeScript + Vite. This is the actual
+UI; it is served on the web and **bundled unchanged** into `Fabric.Desktop`
+(Electron) and `Fabric.Android` (Capacitor).

-Currently, two official plugins are available:
+## What it does

- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Oxc](https://oxc.rs)
- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/)
+- **Auth** — login screen with a configurable Center API base
+  (default `http://localhost:7001/api`); discovers the user's guilds and
+  short-lived guild access tokens; refreshes on mount.
+- **Discord-style dark UI** — server rail / channel sidebar / messages /
+  members layout; per-`x_type` channel colors + badges.
+- **Messaging** — per-message Markdown render (HTML-escaped, XSS-safe, no
+  cross-message bleed), `<@id>` mention chips (resolved to display names,
+  backtick-aware), no message length cap.
+- **Channels** — create-channel modal (required Type, Public, members,
+  triage on-duty, custom listeners, discuss/work **bypass** multi-select);
+  join/leave; closed-channel read-only banner.
+- **Members** — split "In channel" / "Guild" panels for non-public channels;
+  discuss/work bypass tag + "→ bypass" action.
+- **Files** — composer attach (multi-file) with chips; image previews /
+  download chips (via `?access_token`).
+- **Canvas** — pinned per-channel document panel (Markdown / sandboxed HTML
+  iframe / plain text), live via `canvas.*` sockets; sharer-only edit/remove.
+- **Right-click menus** — native menu overridden with resource-specific
+  context menus (guild / channel / message / user / blank areas).
+- **Slash autocomplete** — typing `/` opens a command panel from the
+  guild's synced OpenClaw catalog (`GET /api/commands`): filter, ↑↓/Enter/
+  Esc, pick inserts `/<name> `, arg stage shows args + clickable choices.
+- **Dev mode** — surfaces guild `/ack` and per-message `wakeup` metadata
+  (off by default; persisted in `localStorage`).
+- Routing is `BrowserRouter` on the web and `HashRouter` under `file://`
+  (the Electron bundle); Capacitor serves over `http://localhost` so it
+  uses `BrowserRouter`.

-## React Compiler
+## Develop

-The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
-
-## Expanding the ESLint configuration
-
-If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:
-
-```js
-export default defineConfig([
-  globalIgnores(['dist']),
-  {
-    files: ['**/*.{ts,tsx}'],
-    extends: [
-      // Other configs...
-
-      // Remove tseslint.configs.recommended and replace with this
-      tseslint.configs.recommendedTypeChecked,
-      // Alternatively, use this for stricter rules
-      tseslint.configs.strictTypeChecked,
-      // Optionally, add this for stylistic rules
-      tseslint.configs.stylisticTypeChecked,
-
-      // Other configs...
-    ],
-    languageOptions: {
-      parserOptions: {
-        project: ['./tsconfig.node.json', './tsconfig.app.json'],
-        tsconfigRootDir: import.meta.dirname,
-      },
-      // other options...
-    },
-  },
-])
+```bash
+npm install
+npm run dev          # Vite dev server (http://localhost:5173)
 ```

-You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:
+## Build

-```js
-// eslint.config.js
-import reactX from 'eslint-plugin-react-x'
-import reactDom from 'eslint-plugin-react-dom'
-
-export default defineConfig([
-  globalIgnores(['dist']),
-  {
-    files: ['**/*.{ts,tsx}'],
-    extends: [
-      // Other configs...
-      // Enable lint rules for React
-      reactX.configs['recommended-typescript'],
-      // Enable lint rules for React DOM
-      reactDom.configs.recommended,
-    ],
-    languageOptions: {
-      parserOptions: {
-        project: ['./tsconfig.node.json', './tsconfig.app.json'],
-        tsconfigRootDir: import.meta.dirname,
-      },
-      // other options...
-    },
-  },
-])
+```bash
+npm run build          # web build (absolute base) -> dist/
+npm run build:desktop  # relative-base build -> dist-desktop/  (Electron, file://)
 ```
+
+`Fabric.Desktop` / `Fabric.Android` run their own scripts that invoke these
+builds and copy the output into their shells — you normally don't build for
+them by hand.
+
+## Notes
+
+- ES modules, Vite. App icons / favicon use the Fabric mark
+  (`public/favicon.svg` is a vectorized, deep-green version; PNG fallbacks +
+  `apple-touch-icon`). Favicon hrefs are versioned (`?v=`) for cache-busting.
+- The Center API base is entered at login, so desktop/mobile builds (no web
+  origin) just point at the right backend host.
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+set -e
+
+# Inject container env into the static SPA at runtime. The app loads
+# /runtime-env.js (see index.html) before its bundle.
+#   FABRIC_OIDC_ONLY  - "true" hides the username/password login form
+#   FIX_TO_CENTER     - non-empty pins the Center API base + hides its input
+ONLY="false"
+case "$(printf '%s' "${FABRIC_OIDC_ONLY:-}" | tr '[:upper:]' '[:lower:]')" in
+  1|true|yes|on) ONLY="true" ;;
+esac
+
+# JSON-escape FIX_TO_CENTER (backslash + double-quote)
+FIX="$(printf '%s' "${FIX_TO_CENTER:-}" | sed 's/\\/\\\\/g; s/"/\\"/g')"
+
+cat > /usr/share/nginx/html/runtime-env.js <<EOF
+window.__FABRIC_ENV__ = { oidcOnly: ${ONLY}, fixToCenter: "${FIX}" };
+EOF
+
+exec "$@"
--- a/index.html
+++ b/index.html
@@ -2,16 +2,25 @@
 <html lang="en">
  <head>
    <meta charset="UTF-8" />
-    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32.png" />
-    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16.png" />
-    <link rel="icon" type="image/png" sizes="256x256" href="/favicon.png" />
-    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg?v=3" />
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32.png?v=3" />
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16.png?v=3" />
+    <link rel="icon" type="image/png" sizes="256x256" href="/favicon.png?v=3" />
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png?v=3" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <meta name="theme-color" content="#000000" />
+    <meta name="theme-color" content="#080a0d" />
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link
+      href="https://fonts.googleapis.com/css2?family=Major+Mono+Display&family=IBM+Plex+Mono:ital,wght@0,400;0,500;0,600;1,400&display=swap"
+      rel="stylesheet"
+    />
    <title>Fabric</title>
  </head>
  <body>
    <div id="root"></div>
+    <!-- runtime container env (generated by docker/entrypoint.sh); absent in dev -->
+    <script src="/runtime-env.js"></script>
    <script type="module" src="/src/main.tsx"></script>
  </body>
 </html>
--- a/package.json
+++ b/package.json
@@ -7,7 +7,8 @@
    "dev": "vite",
    "build": "tsc -b && vite build",
    "lint": "eslint .",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "build:desktop": "tsc -b && vite build --base=./ --outDir dist-desktop"
  },
  "dependencies": {
    "axios": "^1.16.0",
--- a/public/apple-touch-icon.png
+++ b/public/apple-touch-icon.png
--- a/public/brand-logo.svg
+++ b/public/brand-logo.svg
@@ -0,0 +1,44 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 733.000000 733.000000" role="img" aria-label="Hangman Lab">
+<g transform="translate(0.000000,733.000000) scale(0.100000,-0.100000)"
+fill="#9333ea" stroke="none">
+<path d="M812 6860 c-66 -40 -73 -66 -70 -242 3 -141 5 -159 24 -185 43 -58
+63 -63 262 -64 l182 -1 0 -2694 0 -2694 -290 0 c-314 0 -332 -3 -380 -54 -24
+-27 -25 -32 -28 -199 -3 -195 4 -218 71 -250 32 -16 257 -17 3084 -17 2955 0
+3049 1 3083 19 65 34 75 66 75 236 0 186 -16 224 -104 254 -25 8 -682 11
+-2512 11 l-2479 0 0 1998 0 1997 698 697 697 697 670 -3 c369 -2 680 -4 693
+-5 22 -1 22 -1 22 -269 l0 -268 84 -12 c47 -7 103 -19 125 -27 41 -14 41 -14
+43 283 l3 297 631 1 c698 2 673 -1 714 67 18 28 20 51 20 187 0 173 -8 201
+-72 240 -33 20 -56 20 -2623 20 -2567 0 -2590 0 -2623 -20z m1725 -500 c-1 -3
+-183 -185 -404 -404 l-403 -399 0 405 0 406 405 -1 c223 -1 404 -4 402 -7z
+M4283 5701 c-459 -125 -690 -624 -483 -1046 67 -138 196 -266 335 -335 281
+-139 612 -93 837 118 235 219 297 575 152 870 -85 174 -235 306 -427 375 -111
+40 -302 48 -414 18z m267 -211 c95 -15 201 -70 274 -144 273 -274 173 -723
+-189 -851 -93 -33 -236 -35 -326 -5 -202 68 -340 249 -356 465 -18 242 153
+471 394 529 71 18 119 19 203 6z M5945 4716 c-56 -25 -80 -61 -80 -122 0 -48
+4 -57 36 -90 88 -88 219 -29 219 98 0 45 -34 96 -75 114 -42 17 -61 17 -100 0z
+M5675 4466 c-60 -26 -73 -109 -26 -157 62 -61 161 -19 161 70 0 74 -68 118
+-135 87z M3747 4397 c-10 -7 -226 -223 -479 -482 -307 -313 -467 -483 -479
+-510 -35 -75 -17 -177 38 -227 39 -35 114 -61 160 -54 100 13 104 17 583 554
+l145 162 3 -404 c3 -455 15 -342 -137 -1186 -76 -423 -101 -587 -101 -664 0
+-190 182 -307 377 -242 62 21 136 95 152 152 6 22 29 188 52 369 57 466 109
+839 118 848 4 4 52 6 106 5 l99 -3 67 -210 c38 -115 68 -220 69 -232 0 -12
+-38 -152 -85 -311 -47 -159 -85 -302 -85 -317 0 -128 109 -225 255 -225 109 1
+185 42 228 125 26 51 237 683 237 710 0 11 -54 182 -121 380 -121 360 -121
+360 -134 605 -8 135 -14 292 -14 350 l0 105 152 -158 c84 -87 166 -167 182
+-177 44 -29 98 -26 135 8 38 35 187 379 173 401 -5 8 -34 20 -64 26 -59 11
+-38 -8 -393 362 -89 93 -100 97 -174 59 -59 -30 -161 -62 -229 -71 -52 -7 -53
+-7 -53 -41 0 -44 -21 -84 -61 -118 -38 -32 -41 0 32 -455 l52 -325 -82 -78
+c-45 -43 -85 -78 -89 -78 -4 0 -42 35 -84 78 l-77 77 34 215 c19 118 46 289
+61 379 26 164 26 164 -5 188 -42 33 -54 58 -61 121 -5 54 -5 54 -92 87 -98 38
+-184 89 -243 145 -76 70 -123 87 -168 57z M5504 4170 c-74 -30 -69 -170 6
+-170 19 0 20 -7 20 -123 0 -122 0 -122 -54 -262 -30 -77 -97 -243 -150 -369
+-106 -252 -113 -287 -73 -347 46 -70 38 -69 560 -69 327 0 475 3 490 11 69 35
+107 109 88 172 -5 17 -62 142 -126 277 -225 470 -215 443 -215 586 0 114 2
+124 18 124 57 0 72 101 23 151 -29 29 -29 29 -298 28 -147 0 -278 -4 -289 -9z
+m376 -307 c1 -148 1 -148 81 -333 101 -231 98 -222 68 -216 -13 3 -116 22
+-229 42 -112 19 -208 37 -212 40 -4 2 18 75 48 160 54 156 54 156 54 305 l0
+149 95 0 95 0 0 -147z m-219 -593 c22 0 49 -42 49 -75 0 -46 -29 -75 -74 -75
+-37 0 -76 36 -76 71 0 46 45 94 78 83 8 -2 18 -4 23 -4z m327 -126 c53 -59 -7
+-144 -80 -113 -54 22 -65 83 -22 125 30 31 67 27 102 -12z"/>
+</g>
+</svg>
--- a/public/favicon-16.png
+++ b/public/favicon-16.png
--- a/public/favicon-32.png
+++ b/public/favicon-32.png
--- a/public/favicon.png
+++ b/public/favicon.png
--- a/public/favicon.svg
+++ b/public/favicon.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 1000" role="img" aria-label="Fabric"><path fill="#1DB800" fill-rule="evenodd" d="M 496.1,636.7 L 484.4,640.6 L 455.1,658.2 L 447.3,668.0 L 445.3,673.8 L 445.3,716.8 L 449.2,726.6 L 455.1,732.4 L 474.6,742.2 L 478.5,746.1 L 490.2,752.0 L 507.8,752.0 L 537.1,736.3 L 548.8,726.6 L 552.7,718.8 L 552.7,671.9 L 548.8,664.1 L 537.1,654.3 L 509.8,638.7 Z M 498.0,673.8 L 503.9,675.8 L 517.6,685.5 L 517.6,705.1 L 503.9,714.8 L 496.1,714.8 L 480.5,705.1 L 480.5,685.5 L 488.3,681.6 Z M 498.0,494.1 L 496.1,496.1 L 490.2,496.1 L 480.5,507.8 L 480.5,599.6 L 490.2,611.3 L 494.1,611.3 L 496.1,613.3 L 509.8,609.4 L 515.6,601.6 L 515.6,507.8 L 505.9,496.1 L 500.0,496.1 Z M 804.7,484.4 L 800.8,488.3 L 798.8,488.3 L 791.0,498.0 L 791.0,502.0 L 789.1,503.9 L 789.1,515.6 L 794.9,527.3 L 806.6,535.2 L 826.2,535.2 L 830.1,533.2 L 841.8,519.5 L 841.8,500.0 L 839.8,496.1 L 826.2,484.4 L 820.3,484.4 L 818.4,482.4 Z M 722.7,484.4 L 710.9,494.1 L 709.0,502.0 L 707.0,503.9 L 707.0,515.6 L 712.9,527.3 L 724.6,535.2 L 742.2,535.2 L 744.1,533.2 L 748.0,533.2 L 755.9,525.4 L 759.8,517.6 L 759.8,500.0 L 757.8,496.1 L 744.1,484.4 L 738.3,484.4 L 736.3,482.4 Z M 640.6,484.4 L 636.7,488.3 L 634.8,488.3 L 627.0,498.0 L 627.0,502.0 L 625.0,503.9 L 625.0,515.6 L 627.0,517.6 L 627.0,521.5 L 634.8,531.2 L 642.6,535.2 L 662.1,535.2 L 666.0,533.2 L 677.7,519.5 L 677.7,500.0 L 675.8,496.1 L 662.1,484.4 L 656.2,484.4 L 654.3,482.4 Z M 337.9,484.4 L 334.0,486.3 L 322.3,500.0 L 322.3,519.5 L 324.2,523.4 L 337.9,535.2 L 357.4,535.2 L 369.1,527.3 L 375.0,515.6 L 375.0,503.9 L 373.0,502.0 L 373.0,498.0 L 369.1,494.1 L 369.1,492.2 L 359.4,484.4 L 353.5,484.4 L 351.6,482.4 Z M 255.9,484.4 L 248.0,488.3 L 240.2,500.0 L 240.2,503.9 L 238.3,505.9 L 238.3,513.7 L 240.2,515.6 L 240.2,519.5 L 242.2,523.4 L 255.9,535.2 L 275.4,535.2 L 289.1,523.4 L 293.0,515.6 L 293.0,503.9 L 287.1,492.2 L 283.2,488.3 L 275.4,484.4 L 269.5,484.4 L 267.6,482.4 Z M 173.8,484.4 L 166.0,488.3 L 162.1,492.2 L 158.2,500.0 L 158.2,503.9 L 156.2,505.9 L 156.2,513.7 L 158.2,515.6 L 158.2,519.5 L 160.2,523.4 L 173.8,535.2 L 193.4,535.2 L 207.0,523.4 L 210.9,515.6 L 210.9,503.9 L 205.1,492.2 L 201.2,488.3 L 193.4,484.4 L 187.5,484.4 L 185.5,482.4 Z M 455.1,210.9 L 421.9,224.6 L 392.6,250.0 L 363.3,296.9 L 353.5,332.0 L 357.4,388.7 L 425.8,484.4 L 425.8,601.6 L 390.6,638.7 L 384.8,652.3 L 384.8,734.4 L 392.6,750.0 L 447.3,800.8 L 535.2,804.7 L 556.6,796.9 L 607.4,746.1 L 613.3,732.4 L 613.3,652.3 L 607.4,638.7 L 570.3,599.6 L 570.3,484.4 L 636.7,394.5 L 642.6,337.9 L 632.8,298.8 L 609.4,259.8 L 578.1,232.4 L 560.5,224.6 L 541.0,224.6 L 529.3,238.3 L 529.3,250.0 L 544.9,298.8 L 544.9,335.9 L 513.7,357.4 L 509.8,392.6 L 498.0,400.4 L 496.1,378.9 L 484.4,363.3 L 496.1,345.7 L 496.1,332.0 L 482.4,316.4 L 496.1,298.8 L 494.1,283.2 L 480.5,269.5 L 488.3,230.5 L 476.6,212.9 Z M 439.5,255.9 L 443.4,257.8 L 439.5,279.3 L 451.2,293.0 L 439.5,310.5 L 439.5,324.2 L 453.1,337.9 L 439.5,355.5 L 439.5,367.2 L 460.9,390.6 L 460.9,400.4 L 449.2,419.9 L 449.2,431.6 L 460.9,443.4 L 509.8,435.5 L 541.0,414.1 L 544.9,378.9 L 578.1,353.5 L 580.1,283.2 L 595.7,302.7 L 605.5,330.1 L 605.5,377.0 L 580.1,416.0 L 543.0,457.0 L 535.2,480.5 L 535.2,605.5 L 541.0,621.1 L 578.1,658.2 L 578.1,726.6 L 533.2,769.5 L 464.8,769.5 L 419.9,726.6 L 419.9,658.2 L 455.1,621.1 L 460.9,607.4 L 460.9,480.5 L 451.2,455.1 L 414.1,414.1 L 392.6,380.9 L 388.7,337.9 L 402.3,296.9 Z M 271.5,123.0 L 248.0,148.4 L 60.5,486.3 L 60.5,519.5 L 70.3,544.9 L 252.0,859.4 L 273.4,880.9 L 304.7,892.6 L 697.3,892.6 L 728.5,880.9 L 753.9,853.5 L 941.4,515.6 L 929.7,459.0 L 750.0,142.6 L 720.7,117.2 L 693.4,109.4 L 308.6,109.4 Z M 294.9,150.4 L 308.6,144.5 L 693.4,144.5 L 724.6,168.0 L 900.4,478.5 L 906.2,513.7 L 722.7,837.9 L 705.1,853.5 L 306.6,857.4 L 275.4,830.1 L 101.6,529.3 L 93.8,502.0 L 277.3,168.0 Z"/></svg>
--- a/public/icon-512.png
+++ b/public/icon-512.png
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -3,6 +3,7 @@ import ProtectedRoute from './auth/ProtectedRoute'
 import AppLayout from './layouts/AppLayout'
 import ChatPage from './pages/ChatPage'
 import LoginPage from './pages/LoginPage'
+import OidcCallback from './pages/OidcCallback'

 export default function App() {
  return (
@@ -26,6 +27,7 @@ export default function App() {
          }
        />
        <Route path="login" element={<LoginPage />} />
+        <Route path="oidc" element={<OidcCallback />} />
      </Route>
      <Route path="*" element={<Navigate to="/workspace" replace />} />
    </Routes>
--- a/src/auth/AuthContext.tsx
+++ b/src/auth/AuthContext.tsx
@@ -18,6 +18,11 @@ export function AuthProvider({ children }: PropsWithChildren) {
        setAuthSession(next)
        setSession(next)
      },
+      // Adopt a session obtained out-of-band (OIDC ticket exchange).
+      adoptSession: (next: AuthSession) => {
+        setAuthSession(next)
+        setSession(next)
+      },
      logout: async () => {
        if (session?.refreshToken) {
          try {
--- a/src/auth/auth-context.ts
+++ b/src/auth/auth-context.ts
@@ -5,6 +5,7 @@ export type AuthContextValue = {
  session: AuthSession | null
  isAuthed: boolean
  login: (centerApiBase: string, email: string, password: string) => Promise<void>
+  adoptSession: (session: AuthSession) => void
  logout: () => Promise<void>
  ensureFreshToken: () => Promise<string | null>
  refreshGuilds: () => Promise<void>
--- a/src/index.css
+++ b/src/index.css
@@ -1,28 +1,32 @@
 :root {
-  --rail: #18191c;
-  --side: #1f2125;
-  --main: #26282d;
-  --elevated: #1a1b1e;
-  --input: #1a1b1e;
-  --hover: rgba(255, 255, 255, 0.04);
-  --active: rgba(168, 85, 247, 0.16);
+  /* Cryptic lab terminal: deep "blueprint" ink surfaces, monospace
+     everything, restrained motion. Accent stays Fabric purple. */
+  --ink: #080a0d;
+  --rail: #0b0e12;
+  --side: #0f141b;
+  --main: #0a0d12;
+  --elevated: #11161d;
+  --input: #0b0e12;
+  --hover: rgba(168, 85, 247, 0.1);
+  --active: rgba(168, 85, 247, 0.18);

-  --text: #dbdee1;
-  --text-muted: #949ba4;
-  --text-faint: #6d7178;
-  --text-h: #f2f3f5;
+  --text: #c7d0dc;
+  --text-muted: #6f7d92;
+  --text-faint: #4f5b6b;
+  --text-h: #e9f0fa;

-  --border: #303237;
+  --border: #1d2733;
  --accent: #a855f7;
  --accent-strong: #9333ea;
-  --accent-soft: rgba(168, 85, 247, 0.14);
-  --danger: #f23f42;
+  --accent-soft: rgba(168, 85, 247, 0.16);
+  --danger: #ff5a52;
  --online: #23a55a;

-  --radius: 10px;
-  --radius-sm: 7px;
-  --sans: 'Inter', system-ui, 'Segoe UI', Roboto, sans-serif;
-  --mono: ui-monospace, 'SF Mono', Consolas, monospace;
+  --radius: 12px;
+  --radius-sm: 8px;
+  --display: 'Major Mono Display', ui-monospace, monospace;
+  --sans: 'IBM Plex Mono', ui-monospace, 'SF Mono', Consolas, monospace;
+  --mono: 'IBM Plex Mono', ui-monospace, 'SF Mono', Consolas, monospace;

  color-scheme: dark;
  font-synthesis: none;
@@ -198,6 +202,27 @@ button {
  padding: 32px;
  box-shadow: 0 20px 50px -20px rgba(0, 0, 0, 0.6);
 }
+.brand-wordmark {
+  font-family: var(--display);
+  text-transform: lowercase;
+  font-size: 30px;
+  color: var(--accent);
+  text-shadow: 0 0 32px rgba(168, 85, 247, 0.4);
+  margin-bottom: 18px;
+}
+.brand-logo {
+  max-height: 44px;
+  width: auto;
+  margin-bottom: 18px;
+}
+.login-or {
+  text-align: center;
+  color: var(--text-faint);
+  font-size: 11px;
+  letter-spacing: 0.18em;
+  text-transform: uppercase;
+  margin: 14px 0;
+}
 .login-card h1 {
  font-size: 24px;
  margin-bottom: 4px;
@@ -415,6 +440,20 @@ button {
 .chan-btn.xt-custom {
  --xt: #c084fc;
 }
+.chan-btn.xt-dm {
+  --xt: #a855f7;
+}
+/* x-type group headers in the channel sidebar */
+.dc-chan-group {
+  margin-bottom: 6px;
+}
+.dc-group-label {
+  font-size: 10px;
+  letter-spacing: 0.18em;
+  text-transform: uppercase;
+  color: var(--text-faint);
+  padding: 8px 8px 4px;
+}
 .chan-tag {
  margin-left: auto;
  font-size: 10px;
@@ -995,3 +1034,88 @@ textarea.canvas-src {
  max-width: 720px;
  width: 92vw;
 }
+
+/* ---- slash command autocomplete ---- */
+.slash-panel {
+  border: 1px solid var(--border);
+  border-bottom: 0;
+  background: var(--elevated);
+  border-radius: var(--radius-sm) var(--radius-sm) 0 0;
+  max-height: 320px;
+  overflow: auto;
+  padding: 6px;
+}
+.slash-panel .slash-hint {
+  font-size: 11px;
+  color: var(--text-faint);
+  padding: 4px 8px 6px;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+.slash-item {
+  display: flex;
+  gap: 10px;
+  align-items: baseline;
+  width: 100%;
+  text-align: left;
+  background: none;
+  border: 0;
+  color: var(--text);
+  padding: 7px 8px;
+  border-radius: 5px;
+  cursor: pointer;
+}
+.slash-item.sel,
+.slash-item:hover {
+  background: var(--accent-soft);
+}
+.slash-item .sc-name {
+  font-family: var(--mono);
+  font-size: 13px;
+  color: var(--text-h);
+  white-space: nowrap;
+}
+.sc-desc {
+  font-size: 12px;
+  color: var(--text-muted);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.slash-arg {
+  padding: 6px 8px;
+  border-top: 1px solid var(--border);
+}
+.slash-arg .sa-name {
+  font-family: var(--mono);
+  font-size: 13px;
+  color: var(--text-h);
+}
+.slash-arg .sa-req {
+  color: var(--danger);
+  margin-left: 1px;
+}
+.slash-arg .sa-type {
+  font-size: 11px;
+  color: var(--text-faint);
+  margin: 0 8px;
+}
+.sa-choices {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  margin-top: 6px;
+}
+.sa-choice {
+  font-size: 12px;
+  background: var(--input);
+  border: 1px solid var(--border);
+  color: var(--text);
+  padding: 3px 8px;
+  border-radius: 999px;
+  cursor: pointer;
+}
+.sa-choice:hover {
+  border-color: var(--accent);
+  color: var(--text-h);
+}
--- a/src/lib/brand.ts
+++ b/src/lib/brand.ts
@@ -0,0 +1,21 @@
+// Build-time brand overrides. Values are baked from VITE_ env at build
+// (not runtime-configurable by design). Empty/unset → Fabric defaults.
+const env = import.meta.env as unknown as Record<string, string | undefined>
+
+export const APP_NAME = (env.VITE_APP_NAME ?? '').trim() || 'Fabric'
+export const LOGO_URL = (env.VITE_LOGO_URL ?? '').trim()
+const FAVICON_URL = (env.VITE_FAVICON_URL ?? '').trim()
+
+// Apply the document title + favicon override once at startup.
+export function applyBrand(): void {
+  document.title = APP_NAME
+  if (FAVICON_URL) {
+    document
+      .querySelectorAll('link[rel~="icon"], link[rel="apple-touch-icon"]')
+      .forEach((n) => n.remove())
+    const link = document.createElement('link')
+    link.rel = 'icon'
+    link.href = FAVICON_URL
+    document.head.appendChild(link)
+  }
+}
--- a/src/lib/center-auth-client.ts
+++ b/src/lib/center-auth-client.ts
@@ -82,6 +82,20 @@ export async function guildMembersCenter(
  return Array.isArray(res.data) ? res.data : []
 }

+export async function oidcStatusCenter(centerApiBase: string): Promise<{ enabled: boolean }> {
+  try {
+    const res = await centerClient(centerApiBase).get<{ enabled: boolean }>('/auth/oidc/status')
+    return { enabled: !!res.data?.enabled }
+  } catch {
+    return { enabled: false }
+  }
+}
+
+export async function oidcExchangeCenter(centerApiBase: string, ticket: string): Promise<AuthSession> {
+  const res = await centerClient(centerApiBase).post<LoginResponse>('/auth/oidc/exchange', { ticket })
+  return { ...res.data, centerApiBase }
+}
+
 export async function updateMeNameCenter(
  centerApiBase: string,
  accessToken: string,
--- a/src/lib/runtime-env.ts
+++ b/src/lib/runtime-env.ts
@@ -0,0 +1,37 @@
+// Runtime (container) env, injected by the Docker entrypoint into
+// /runtime-env.js as window.__FABRIC_ENV__ (NOT build-time). Empty/unset
+// keeps the prior behavior.
+type FabricEnv = { oidcOnly?: boolean; fixToCenter?: string }
+
+const env: FabricEnv =
+  (typeof window !== 'undefined' && (window as unknown as { __FABRIC_ENV__?: FabricEnv }).__FABRIC_ENV__) || {}
+
+// FABRIC_OIDC_ONLY: hide the username/password form (SSO is the only login).
+export const OIDC_ONLY = env.oidcOnly === true
+
+// FIX_TO_CENTER: when non-empty, the Center API base is pinned to this and
+// the login page no longer shows the "Center API Base" input.
+export const FIXED_CENTER = (env.fixToCenter ?? '').trim()
+
+export const DEFAULT_CENTER = 'http://localhost:7001/api'
+
+// Where OIDC exchange should call back to. FIX_TO_CENTER wins; otherwise
+// the value the user used to start SSO (persisted before redirect).
+const OIDC_CENTER_KEY = 'fabric.oidc.center.v1'
+export function rememberOidcCenter(base: string): void {
+  try {
+    localStorage.setItem(OIDC_CENTER_KEY, base)
+  } catch {
+    // ignore
+  }
+}
+export function resolveCenterBase(): string {
+  if (FIXED_CENTER) return FIXED_CENTER
+  try {
+    const v = localStorage.getItem(OIDC_CENTER_KEY)
+    if (v) return v
+  } catch {
+    // ignore
+  }
+  return DEFAULT_CENTER
+}
--- a/src/main.tsx
+++ b/src/main.tsx
@@ -1,16 +1,24 @@
 import { StrictMode } from 'react'
 import { createRoot } from 'react-dom/client'
-import { BrowserRouter } from 'react-router-dom'
+import { BrowserRouter, HashRouter } from 'react-router-dom'
 import './index.css'
 import App from './App.tsx'
 import { AuthProvider } from './auth/AuthContext'
+import { applyBrand } from './lib/brand'
+
+applyBrand()
+
+// The packaged desktop app loads the bundled SPA over file://, where the
+// History API has no server to back path routing — use HashRouter there.
+// The web build (served over http behind nginx) keeps clean BrowserRouter URLs.
+const Router = window.location.protocol === 'file:' ? HashRouter : BrowserRouter

 createRoot(document.getElementById('root')!).render(
  <StrictMode>
-    <BrowserRouter>
+    <Router>
      <AuthProvider>
        <App />
      </AuthProvider>
-    </BrowserRouter>
+    </Router>
  </StrictMode>,
 )
--- a/src/pages/ChatPage.tsx
+++ b/src/pages/ChatPage.tsx
@@ -1,8 +1,15 @@
 import axios from 'axios'
 import { io, type Socket } from 'socket.io-client'
-import { useEffect, useMemo, useState, type MouseEvent as ReactMouseEvent } from 'react'
+import {
+  useEffect,
+  useMemo,
+  useState,
+  type MouseEvent as ReactMouseEvent,
+  type KeyboardEvent as ReactKeyboardEvent,
+} from 'react'
 import { useAuth } from '../auth/auth-context'
 import { renderMarkdown } from '../lib/markdown'
+import { APP_NAME } from '../lib/brand'
 import { guildMembersCenter, joinGuildCenter } from '../lib/center-auth-client'

 type Attachment = { url: string; name?: string; mimeType?: string }
@@ -20,6 +27,23 @@ type MessageItem = {
 }

 type CanvasFormat = 'md' | 'html' | 'text'
+type SlashArg = {
+  name: string
+  description: string
+  type: string
+  required: boolean
+  captureRemaining: boolean
+  choices: Array<{ value: string; label: string }> | null
+}
+type SlashCommand = {
+  name: string
+  nativeName: string
+  description: string
+  acceptsArgs: boolean
+  args: SlashArg[]
+  argsParsing: string
+}
+
 type CanvasDoc = {
  channelId: string
  sharerUserId: string
@@ -44,7 +68,13 @@ function timeOf(iso?: string): string {
  return d.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' })
 }

-const X_TYPES = ['general', 'work', 'report', 'discuss', 'triage', 'custom'] as const
+const X_TYPES = ['general', 'work', 'report', 'discuss', 'triage', 'custom', 'dm'] as const
+// display order + labels for the x-type-grouped channel sidebar
+const XTYPE_ORDER = ['general', 'work', 'report', 'discuss', 'triage', 'custom', 'dm'] as const
+const XTYPE_LABEL: Record<string, string> = {
+  general: 'General', work: 'Work', report: 'Report',
+  discuss: 'Discussion', triage: 'Triage', custom: 'Custom', dm: 'Direct Messages',
+}
 type XType = (typeof X_TYPES)[number]

 type GuildChannel = { id: string; name: string; guildId?: string; xType?: XType; isMember?: boolean; isPublic?: boolean; closed?: boolean }
@@ -92,6 +122,8 @@ export default function ChatPage() {
  const [canvasFormat, setCanvasFormat] = useState<CanvasFormat>('md')
  const [canvasSource, setCanvasSource] = useState('')
  const [canvasEditMode, setCanvasEditMode] = useState(false)
+  const [slashCmds, setSlashCmds] = useState<SlashCommand[]>([])
+  const [slashSel, setSlashSel] = useState(0)

  function openCtx(e: ReactMouseEvent, title: string, items: MenuItem[]) {
    e.preventDefault()
@@ -281,6 +313,20 @@ export default function ChatPage() {
    }
  }

+  async function loadCommands() {
+    if (!guild || !guildToken) {
+      setSlashCmds([])
+      return
+    }
+    try {
+      const res = await guildApi().get('/commands')
+      const list = Array.isArray(res.data?.commands) ? (res.data.commands as SlashCommand[]) : []
+      setSlashCmds(list)
+    } catch {
+      setSlashCmds([])
+    }
+  }
+
  function openCanvasShare() {
    setCanvasEditMode(false)
    setCanvasTitle('')
@@ -373,13 +419,17 @@ export default function ChatPage() {
      setError('Triage channels require an on-duty user')
      return
    }
+    if (newChannelXType === 'dm' && selectedMemberIds.length !== 1) {
+      setError('A DM needs exactly one other participant')
+      return
+    }
    setError('')
    try {
      const payload = {
        name: newChannelName.trim(),
        guildId: effectiveGuildId,
        xType: newChannelXType,
-        isPublic: newChannelPublic,
+        isPublic: newChannelXType === 'dm' ? false : newChannelPublic,
        memberUserIds: selectedMemberIds,
        onDuty: newChannelXType === 'triage' ? newChannelOnDuty : undefined,
        listeners: newChannelXType === 'custom' ? newChannelListeners : [],
@@ -405,6 +455,33 @@ export default function ChatPage() {
    }
  }

+  // DM channels are not unique: this always creates a fresh 1:1 dm channel
+  // between the current user and `m` (private; no rotation/wakeup).
+  async function createDmChannel(m: { userId: string; name?: string; email?: string }) {
+    if (!guild || !guildToken) return
+    const effectiveGuildId = guildDbId || selectedGuildId
+    if (!effectiveGuildId) {
+      setError('Cannot create DM: no guild selected')
+      return
+    }
+    const label = m.name || m.email || m.userId.slice(0, 8)
+    setError('')
+    try {
+      const res = await guildApi().post('/channels', {
+        name: `DM · ${label}`,
+        guildId: effectiveGuildId,
+        xType: 'dm',
+        isPublic: false,
+        memberUserIds: [m.userId],
+      })
+      const createdId = res.data?.id as string | undefined
+      await loadChannels()
+      if (createdId) setSelectedChannelId(createdId)
+    } catch {
+      setError('Failed to create DM channel')
+    }
+  }
+
  async function joinChannel(c: GuildChannel) {
    if (!guild || !guildToken) return
    try {
@@ -490,6 +567,7 @@ export default function ChatPage() {

  useEffect(() => {
    void loadChannels()
+    void loadCommands()
    setMessages([])
    setSelectedChannelId('')
  }, [selectedGuildId, guildDbId, guildToken])
@@ -660,6 +738,15 @@ export default function ChatPage() {
      { kind: 'item', label: 'Copy user ID', onClick: () => copyText(m.userId) },
      { kind: 'item', label: 'Copy name', onClick: () => copyText(label) },
    ]
+    if (!isSelf)
+      items.push(
+        { kind: 'sep' },
+        {
+          kind: 'item',
+          label: 'Create new DM channel',
+          onClick: () => void createDmChannel(m),
+        },
+      )
    if (inChannel && rotationChannel && !bypassMemberIds.includes(m.userId))
      items.push(
        { kind: 'sep' },
@@ -768,8 +855,119 @@ export default function ChatPage() {
    )
  }

+  // ---- slash-command autocomplete ----
+  const slashNameMatch = /^\/(\S*)$/.exec(content)
+  const slashQuery = slashNameMatch ? slashNameMatch[1].toLowerCase() : ''
+  const slashMatches =
+    slashNameMatch && content.startsWith('/')
+      ? slashCmds
+          .filter((c) => c.name.toLowerCase().includes(slashQuery))
+          .sort((a, b) => {
+            const ap = a.name.toLowerCase().startsWith(slashQuery) ? 0 : 1
+            const bp = b.name.toLowerCase().startsWith(slashQuery) ? 0 : 1
+            return ap - bp || a.name.localeCompare(b.name)
+          })
+          .slice(0, 8)
+      : []
+  const showSlashNames = slashMatches.length > 0
+  const slashArgMatch = /^\/(\S+)\s+/.exec(content)
+  const slashActiveCmd =
+    !slashNameMatch && slashArgMatch
+      ? slashCmds.find(
+          (c) => c.nativeName === slashArgMatch[1] || c.name === slashArgMatch[1],
+        ) ?? null
+      : null
+  const showSlashArgs = !!slashActiveCmd && slashActiveCmd.acceptsArgs
+
+  function pickSlash(cmd: SlashCommand) {
+    setContent(`/${cmd.nativeName} `)
+    setSlashSel(0)
+  }
+  function appendSlashValue(v: string) {
+    setContent((c) => `${c.replace(/\s*$/, '')} ${v} `)
+  }
+  function onComposerKey(e: ReactKeyboardEvent<HTMLInputElement>) {
+    if (!showSlashNames) return
+    if (e.key === 'ArrowDown') {
+      e.preventDefault()
+      setSlashSel((s) => Math.min(s + 1, slashMatches.length - 1))
+    } else if (e.key === 'ArrowUp') {
+      e.preventDefault()
+      setSlashSel((s) => Math.max(s - 1, 0))
+    } else if (e.key === 'Enter') {
+      e.preventDefault()
+      pickSlash(slashMatches[slashSel] ?? slashMatches[0])
+    } else if (e.key === 'Escape') {
+      e.preventDefault()
+      setContent('')
+    }
+  }
+
+  function renderSlashPanel() {
+    if (showSlashNames) {
+      return (
+        <div className="slash-panel">
+          <div className="slash-hint">commands · ↑↓ select · Enter pick · Esc clear</div>
+          {slashMatches.map((c, i) => (
+            <button
+              key={c.name}
+              type="button"
+              className={`slash-item ${i === slashSel ? 'sel' : ''}`}
+              onMouseEnter={() => setSlashSel(i)}
+              onClick={() => pickSlash(c)}
+            >
+              <span className="sc-name">/{c.nativeName}</span>
+              <span className="sc-desc">{c.description}</span>
+            </button>
+          ))}
+        </div>
+      )
+    }
+    if (showSlashArgs && slashActiveCmd) {
+      return (
+        <div className="slash-panel">
+          <div className="slash-hint">
+            /{slashActiveCmd.nativeName} — {slashActiveCmd.description}
+          </div>
+          {slashActiveCmd.args.length === 0 ? (
+            <div className="slash-arg">(no arguments)</div>
+          ) : (
+            slashActiveCmd.args.map((a) => (
+              <div key={a.name} className="slash-arg">
+                <div>
+                  <span className="sa-name">
+                    {a.name}
+                    {a.required ? <span className="sa-req">*</span> : null}
+                  </span>
+                  <span className="sa-type">{a.type}</span>
+                  <span className="sc-desc">{a.description}</span>
+                </div>
+                {a.choices && a.choices.length ? (
+                  <div className="sa-choices">
+                    {a.choices.slice(0, 24).map((ch) => (
+                      <button
+                        key={ch.value}
+                        type="button"
+                        className="sa-choice"
+                        onClick={() => appendSlashValue(ch.value)}
+                        title={ch.label}
+                      >
+                        {ch.label}
+                      </button>
+                    ))}
+                  </div>
+                ) : null}
+              </div>
+            ))
+          )}
+        </div>
+      )
+    }
+    return null
+  }
+
  return (
-    <div className="dc-shell" onContextMenu={(e) => openCtx(e, 'Fabric', blankMenu('root'))}>
+    <div className="dc-shell" onContextMenu={(e) => openCtx(e, APP_NAME, blankMenu('root'))}>
      <nav className="dc-rail" onContextMenu={(e) => openCtx(e, 'Guilds', blankMenu('guilds'))}>
        {guilds.map((g) => (
          <button
@@ -801,17 +999,25 @@ export default function ChatPage() {
            </button>
          </div>
          {channels.length ? (
-            channels.map((c) => (
-              <button
-                key={c.id}
-                className={`chan-btn xt-${c.xType ?? 'general'} ${selectedChannelId === c.id ? 'active' : ''}`}
-                onClick={() => setSelectedChannelId(c.id)}
-                onContextMenu={(e) => openCtx(e, `#${c.name}`, channelMenu(c))}
-              >
-                <span className="hash">#</span>
-                <span style={{ overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{c.name}</span>
-                {c.xType ? <span className="chan-tag">{c.xType}</span> : null}
-              </button>
+            XTYPE_ORDER.filter((xt) =>
+              channels.some((c) => (c.xType ?? 'general') === xt),
+            ).map((xt) => (
+              <div key={xt} className="dc-chan-group">
+                <div className="dc-group-label">{XTYPE_LABEL[xt] ?? xt}</div>
+                {channels
+                  .filter((c) => (c.xType ?? 'general') === xt)
+                  .map((c) => (
+                    <button
+                      key={c.id}
+                      className={`chan-btn xt-${c.xType ?? 'general'} ${selectedChannelId === c.id ? 'active' : ''}`}
+                      onClick={() => setSelectedChannelId(c.id)}
+                      onContextMenu={(e) => openCtx(e, `#${c.name}`, channelMenu(c))}
+                    >
+                      <span className="hash">#</span>
+                      <span style={{ overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{c.name}</span>
+                    </button>
+                  ))}
+              </div>
            ))
          ) : (
            <div className="dc-empty">{guild ? 'No channels yet' : 'Pick a guild from the left'}</div>
@@ -1009,6 +1215,7 @@ export default function ChatPage() {
          <div className="dc-closed-banner">This channel is closed — history is read-only.</div>
        ) : (
          <div className="dc-composer-wrap">
+            {renderSlashPanel()}
            {pendingFiles.length ? (
              <div className="pending-files">
                {pendingFiles.map((f, fi) => (
@@ -1054,7 +1261,11 @@ export default function ChatPage() {
              <input
                className="input"
                value={content}
-                onChange={(e) => setContent(e.target.value)}
+                onChange={(e) => {
+                  setContent(e.target.value)
+                  setSlashSel(0)
+                }}
+                onKeyDown={onComposerKey}
                placeholder={currentChannel ? `Message #${currentChannel.name}` : 'Select a channel first'}
                disabled={!currentChannel}
              />
@@ -1217,33 +1428,61 @@ export default function ChatPage() {
              </div>
            ) : null}

-            <label className="check-row" style={{ marginTop: 10 }}>
-              <input type="checkbox" checked={newChannelPublic} onChange={(e) => setNewChannelPublic(e.target.checked)} />
-              <span>Public — visible to all guild members</span>
-            </label>
-            <p className="muted" style={{ marginTop: 8, fontSize: 13 }}>
-              {newChannelPublic
-                ? "You're added automatically; every guild member can see it."
-                : "You're added automatically. Pick who else to include:"}
-            </p>
-            <div className="modal-list">
-              {members
-                .filter((m) => m.userId !== session?.user.id)
-                .map((m) => (
-                  <label key={m.userId} className="check-row">
-                    <input
-                      type="checkbox"
-                      checked={selectedMemberIds.includes(m.userId)}
-                      disabled={newChannelPublic}
-                      onChange={() => toggleMember(m.userId)}
-                    />
-                    <span>{m.name || m.email}</span>
-                  </label>
-                ))}
-              {members.filter((m) => m.userId !== session?.user.id).length === 0 ? (
-                <div className="dc-empty">No other members in this guild.</div>
-              ) : null}
-            </div>
+            {newChannelXType === 'dm' ? (
+              <>
+                <p className="muted" style={{ marginTop: 10, fontSize: 13 }}>
+                  Direct message — private 1:1, not unique. Pick exactly one user:
+                </p>
+                <div className="modal-list">
+                  {members
+                    .filter((m) => m.userId !== session?.user.id)
+                    .map((m) => (
+                      <label key={m.userId} className="check-row">
+                        <input
+                          type="radio"
+                          name="dm-target"
+                          checked={selectedMemberIds[0] === m.userId}
+                          onChange={() => setSelectedMemberIds([m.userId])}
+                        />
+                        <span>{m.name || m.email}</span>
+                      </label>
+                    ))}
+                  {members.filter((m) => m.userId !== session?.user.id).length === 0 ? (
+                    <div className="dc-empty">No other members in this guild.</div>
+                  ) : null}
+                </div>
+              </>
+            ) : (
+              <>
+                <label className="check-row" style={{ marginTop: 10 }}>
+                  <input type="checkbox" checked={newChannelPublic} onChange={(e) => setNewChannelPublic(e.target.checked)} />
+                  <span>Public — visible to all guild members</span>
+                </label>
+                <p className="muted" style={{ marginTop: 8, fontSize: 13 }}>
+                  {newChannelPublic
+                    ? "You're added automatically; every guild member can see it."
+                    : "You're added automatically. Pick who else to include:"}
+                </p>
+                <div className="modal-list">
+                  {members
+                    .filter((m) => m.userId !== session?.user.id)
+                    .map((m) => (
+                      <label key={m.userId} className="check-row">
+                        <input
+                          type="checkbox"
+                          checked={selectedMemberIds.includes(m.userId)}
+                          disabled={newChannelPublic}
+                          onChange={() => toggleMember(m.userId)}
+                        />
+                        <span>{m.name || m.email}</span>
+                      </label>
+                    ))}
+                  {members.filter((m) => m.userId !== session?.user.id).length === 0 ? (
+                    <div className="dc-empty">No other members in this guild.</div>
+                  ) : null}
+                </div>
+              </>
+            )}
            <div className="modal-actions">
              <button className="btn" onClick={createChannel}>Create</button>
              <button className="btn btn-secondary" onClick={() => setShowCreateChannelModal(false)}>Cancel</button>
--- a/src/pages/LoginPage.tsx
+++ b/src/pages/LoginPage.tsx
@@ -1,15 +1,29 @@
-import { useState } from 'react'
+import { useEffect, useState } from 'react'
 import type { FormEvent } from 'react'
 import { useNavigate } from 'react-router-dom'
 import { useAuth } from '../auth/auth-context'
+import { APP_NAME, LOGO_URL } from '../lib/brand'
+import { OIDC_ONLY, FIXED_CENTER, DEFAULT_CENTER, rememberOidcCenter } from '../lib/runtime-env'
+import { oidcStatusCenter } from '../lib/center-auth-client'

 export default function LoginPage() {
  const navigate = useNavigate()
  const { login, isAuthed, session } = useAuth()
-  const [centerApiBase, setCenterApiBase] = useState('http://localhost:7001/api')
+  const [centerApiBase, setCenterApiBase] = useState(FIXED_CENTER || DEFAULT_CENTER)
  const [email, setEmail] = useState('')
  const [password, setPassword] = useState('')
  const [error, setError] = useState('')
+  const [oidcEnabled, setOidcEnabled] = useState(false)
+
+  useEffect(() => {
+    let alive = true
+    oidcStatusCenter(centerApiBase.trim()).then((s) => {
+      if (alive) setOidcEnabled(s.enabled)
+    })
+    return () => {
+      alive = false
+    }
+  }, [centerApiBase])

  async function onSubmit(e: FormEvent) {
    e.preventDefault()
@@ -22,14 +36,29 @@ export default function LoginPage() {
    }
  }

+  function startOidc() {
+    const base = centerApiBase.trim().replace(/\/$/, '')
+    rememberOidcCenter(base)
+    window.location.href = `${base}/auth/oidc/start`
+  }
+
+  const showPasswordForm = !OIDC_ONLY
+  const showCenterInput = !FIXED_CENTER
+
  return (
    <div className="login-screen">
      <div className="login-card">
+        {LOGO_URL ? (
+          <img className="brand-logo" src={LOGO_URL} alt={APP_NAME} />
+        ) : (
+          <div className="brand-wordmark">{APP_NAME}</div>
+        )}
        <h1>Welcome back</h1>
        <p className="login-sub">
-          {isAuthed ? `Signed in as ${session?.user.email}` : 'Sign in to continue to Fabric'}
+          {isAuthed ? `Signed in as ${session?.user.email}` : `Sign in to continue to ${APP_NAME}`}
        </p>
-        <form onSubmit={onSubmit}>
+
+        {showCenterInput ? (
          <div className="field">
            <label>Center API Base</label>
            <input
@@ -39,29 +68,51 @@ export default function LoginPage() {
              placeholder="http://localhost:7001/api"
            />
          </div>
-          <div className="field">
-            <label>Email</label>
-            <input
-              className="input"
-              value={email}
-              onChange={(e) => setEmail(e.target.value)}
-              placeholder="you@example.com"
-              type="email"
-            />
-          </div>
-          <div className="field">
-            <label>Password</label>
-            <input
-              className="input"
-              value={password}
-              onChange={(e) => setPassword(e.target.value)}
-              placeholder="••••••••"
-              type="password"
-            />
-          </div>
-          {error ? <p className="error-text" style={{ marginBottom: 12 }}>{error}</p> : null}
-          <button className="btn" type="submit">Sign in</button>
-        </form>
+        ) : null}
+
+        {oidcEnabled ? (
+          <button className="btn" type="button" onClick={startOidc} style={{ width: '100%' }}>
+            Sign in with SSO
+          </button>
+        ) : null}
+
+        {OIDC_ONLY && !oidcEnabled ? (
+          <p className="error-text" style={{ marginTop: 12 }}>
+            SSO is not configured on this Center yet.
+          </p>
+        ) : null}
+
+        {showPasswordForm ? (
+          <>
+            {oidcEnabled ? <div className="login-or">or</div> : null}
+            <form onSubmit={onSubmit}>
+              <div className="field">
+                <label>Email</label>
+                <input
+                  className="input"
+                  value={email}
+                  onChange={(e) => setEmail(e.target.value)}
+                  placeholder="you@example.com"
+                  type="email"
+                />
+              </div>
+              <div className="field">
+                <label>Password</label>
+                <input
+                  className="input"
+                  value={password}
+                  onChange={(e) => setPassword(e.target.value)}
+                  placeholder="••••••••"
+                  type="password"
+                />
+              </div>
+              {error ? <p className="error-text" style={{ marginBottom: 12 }}>{error}</p> : null}
+              <button className="btn" type="submit">Sign in</button>
+            </form>
+          </>
+        ) : error ? (
+          <p className="error-text" style={{ marginTop: 12 }}>{error}</p>
+        ) : null}
      </div>
    </div>
  )
--- a/src/pages/OidcCallback.tsx
+++ b/src/pages/OidcCallback.tsx
@@ -0,0 +1,66 @@
+import { useEffect, useRef, useState } from 'react'
+import { useNavigate } from 'react-router-dom'
+import { useAuth } from '../auth/auth-context'
+import { APP_NAME } from '../lib/brand'
+import { resolveCenterBase } from '../lib/runtime-env'
+import { oidcExchangeCenter } from '../lib/center-auth-client'
+
+// Landing route for the OIDC redirect: Center bounces the browser here
+// with #oidc_ticket=... (or #oidc_error=...). We redeem the one-time
+// ticket for a full session and adopt it.
+export default function OidcCallback() {
+  const navigate = useNavigate()
+  const { adoptSession } = useAuth()
+  const [error, setError] = useState('')
+  const ran = useRef(false)
+
+  useEffect(() => {
+    if (ran.current) return
+    ran.current = true
+
+    const hash = window.location.hash.replace(/^#/, '')
+    const params = new URLSearchParams(hash)
+    const ticket = params.get('oidc_ticket')
+    const errParam = params.get('oidc_error')
+    // scrub the fragment so the ticket isn't left in the URL/history
+    window.history.replaceState(null, '', window.location.pathname)
+
+    if (errParam) {
+      setError(decodeURIComponent(errParam))
+      return
+    }
+    if (!ticket) {
+      setError('Missing OIDC ticket.')
+      return
+    }
+
+    oidcExchangeCenter(resolveCenterBase(), ticket)
+      .then((next) => {
+        adoptSession(next)
+        navigate('/workspace', { replace: true })
+      })
+      .catch(() => setError('SSO sign-in failed. The ticket may have expired — please try again.'))
+  }, [adoptSession, navigate])
+
+  return (
+    <div className="login-screen">
+      <div className="login-card">
+        <div className="brand-wordmark">{APP_NAME}</div>
+        {error ? (
+          <>
+            <h1>Sign-in failed</h1>
+            <p className="error-text" style={{ marginBottom: 16 }}>{error}</p>
+            <button className="btn" type="button" onClick={() => navigate('/login', { replace: true })}>
+              Back to sign in
+            </button>
+          </>
+        ) : (
+          <>
+            <h1>Signing you in…</h1>
+            <p className="login-sub">Completing SSO authentication.</p>
+          </>
+        )}
+      </div>
+    </div>
+  )
+}
Author	SHA1	Message	Date
hzhang	607785ac0c	feat(frontend): bake Fabric-purple Hangman Lab logo as brand asset public/brand-logo.svg = ~/hangman-lab-logo-black.svg recolored #000000 -> #9333ea (Fabric deep purple). Dockerfile writes .env.production at build (context .env* is dockerignored) so VITE_APP_NAME/LOGO_URL/FAVICON_URL bake in; logo+favicon -> the mark. Overridable via build args. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-18 10:02:14 +01:00
hzhang	92d3b4dc1b	feat(frontend): OIDC login + runtime env (FABRIC_OIDC_ONLY/FIX_TO_CENTER) - Runtime container env injected by docker/entrypoint.sh -> runtime-env.js (loaded before the bundle); src/lib/runtime-env.ts reads it. FABRIC_OIDC_ONLY hides the password form; FIX_TO_CENTER pins the Center base and hides its input. Dockerfile ENTRYPOINT + ENV defaults. - LoginPage: 'Sign in with SSO' when /auth/oidc/status enabled; password form gated by OIDC_ONLY; center input gated by FIX_TO_CENTER. - /oidc route (OidcCallback) redeems the fragment ticket via /auth/oidc/exchange and adopts the session (AuthContext.adoptSession). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-18 09:44:49 +01:00
hzhang	4892af55e8	feat(frontend): terminal restyle + dm + grouping + brand override - Restyle: ink 'blueprint' surfaces + IBM Plex Mono / Major Mono Display, hairline borders, restrained motion, 12px radii. Fabric purple accent kept. Layout unchanged. - Brand override (build-time VITE_ only): VITE_APP_NAME / VITE_LOGO_URL / VITE_FAVICON_URL via src/lib/brand.ts (applyBrand in main.tsx); login wordmark/logo + title + favicon. .env.example documented. - dm x-type: create modal participant becomes single-select (radio) for dm and forces private; member right-click menu gains 'Create new DM channel' (non-unique, fresh channel each time). - Channels sidebar grouped by x-type with group headers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-18 09:18:21 +01:00
hzhang	46cad0ec7c	feat(chat): slash-command autocomplete Typing / opens a command panel from the guild's synced OpenClaw catalog (GET /api/commands): filter + ↑↓/Enter/Esc; pick inserts /<nativeName> ; arg stage lists args (required/type/desc) with clickable choice chips (dynamic choices already snapshotted server-side). Sent as a normal message — execution flows plugin -> OpenClaw command system. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 16:15:02 +01:00
hzhang	8be68d4c87	docs: rewrite README to match current architecture Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 12:53:24 +01:00
hzhang	805f0db300	feat(frontend): file:// bundle support (HashRouter + build:desktop) - main.tsx: use HashRouter when loaded over file:// (packaged desktop has no server for History API path routing); keep BrowserRouter on the http web build. - add build:desktop script (vite build --base=./ --outDir dist-desktop) so assets resolve under file://; gitignore dist-desktop. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 12:11:34 +01:00
hzhang	0d3a333409	fix(brand): bolder strokes + cache-bust favicon - Thicken the mark's strokes (mask dilation ~2.2%) so it reads at tab size; SVG re-traced + all PNGs regenerated, deeper green #1DB800 kept. - The tab kept showing a stale icon because the favicon URL never changed across edits (browsers cache favicons very aggressively). Version the hrefs (?v=3) to force a refetch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 11:21:39 +01:00
hzhang	68e60de3b4	feat(brand): vector SVG favicon + deeper green - favicon.svg: the mark vectorized (OpenCV contour trace of the artwork, even-odd fill) -> crisp at any tab size, ~3KB. Set as the primary <link rel=icon type=image/svg+xml> with PNG fallbacks. - Deepen the green: same hue, full saturation, ~72% value (#1DB800) and embolden faint anti-aliased strokes (alpha gamma) so it no longer looks washed-out at favicon size. - All PNGs (16/32/256, apple-touch, icon-512) regenerated to match. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 11:16:57 +01:00
hzhang	42f6e84709	fix(brand): transparent bg + tight crop for favicon/app icon The mark sat tiny on a black square (invisible in the browser tab). Make the near-black background transparent (alpha from max channel, sub-22 floor removes the glow haze) and crop to the mark's bounding box with ~8% margin so it fills the frame at favicon sizes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 11:10:57 +01:00
hzhang	c4ccfd787f	feat(brand): use no-text mark for favicon/app icon Switch the favicon set + icon-512 + apple-touch-icon to the no-text hexagon+wrench mark so it stays legible at 16-32px (the wordmark version was unreadable at favicon sizes). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 11:07:33 +01:00
				`@@ -0,0 +1 @@`
				<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 1000" role="img" aria-label="Fabric"><path fill="#1DB800" fill-rule="evenodd" d="M 496.1,636.7 L 484.4,640.6 L 455.1,658.2 L 447.3,668.0 L 445.3,673.8 L 445.3,716.8 L 449.2,726.6 L 455.1,732.4 L 474.6,742.2 L 478.5,746.1 L 490.2,752.0 L 507.8,752.0 L 537.1,736.3 L 548.8,726.6 L 552.7,718.8 L 552.7,671.9 L 548.8,664.1 L 537.1,654.3 L 509.8,638.7 Z M 498.0,673.8 L 503.9,675.8 L 517.6,685.5 L 517.6,705.1 L 503.9,714.8 L 496.1,714.8 L 480.5,705.1 L 480.5,685.5 L 488.3,681.6 Z M 498.0,494.1 L 496.1,496.1 L 490.2,496.1 L 480.5,507.8 L 480.5,599.6 L 490.2,611.3 L 494.1,611.3 L 496.1,613.3 L 509.8,609.4 L 515.6,601.6 L 515.6,507.8 L 505.9,496.1 L 500.0,496.1 Z M 804.7,484.4 L 800.8,488.3 L 798.8,488.3 L 791.0,498.0 L 791.0,502.0 L 789.1,503.9 L 789.1,515.6 L 794.9,527.3 L 806.6,535.2 L 826.2,535.2 L 830.1,533.2 L 841.8,519.5 L 841.8,500.0 L 839.8,496.1 L 826.2,484.4 L 820.3,484.4 L 818.4,482.4 Z M 722.7,484.4 L 710.9,494.1 L 709.0,502.0 L 707.0,503.9 L 707.0,515.6 L 712.9,527.3 L 724.6,535.2 L 742.2,535.2 L 744.1,533.2 L 748.0,533.2 L 755.9,525.4 L 759.8,517.6 L 759.8,500.0 L 757.8,496.1 L 744.1,484.4 L 738.3,484.4 L 736.3,482.4 Z M 640.6,484.4 L 636.7,488.3 L 634.8,488.3 L 627.0,498.0 L 627.0,502.0 L 625.0,503.9 L 625.0,515.6 L 627.0,517.6 L 627.0,521.5 L 634.8,531.2 L 642.6,535.2 L 662.1,535.2 L 666.0,533.2 L 677.7,519.5 L 677.7,500.0 L 675.8,496.1 L 662.1,484.4 L 656.2,484.4 L 654.3,482.4 Z M 337.9,484.4 L 334.0,486.3 L 322.3,500.0 L 322.3,519.5 L 324.2,523.4 L 337.9,535.2 L 357.4,535.2 L 369.1,527.3 L 375.0,515.6 L 375.0,503.9 L 373.0,502.0 L 373.0,498.0 L 369.1,494.1 L 369.1,492.2 L 359.4,484.4 L 353.5,484.4 L 351.6,482.4 Z M 255.9,484.4 L 248.0,488.3 L 240.2,500.0 L 240.2,503.9 L 238.3,505.9 L 238.3,513.7 L 240.2,515.6 L 240.2,519.5 L 242.2,523.4 L 255.9,535.2 L 275.4,535.2 L 289.1,523.4 L 293.0,515.6 L 293.0,503.9 L 287.1,492.2 L 283.2,488.3 L 275.4,484.4 L 269.5,484.4 L 267.6,482.4 Z M 173.8,484.4 L 166.0,488.3 L 162.1,492.2 L 158.2,500.0 L 158.2,503.9 L 156.2,505.9 L 156.2,513.7 L 158.2,515.6 L 158.2,519.5 L 160.2,523.4 L 173.8,535.2 L 193.4,535.2 L 207.0,523.4 L 210.9,515.6 L 210.9,503.9 L 205.1,492.2 L 201.2,488.3 L 193.4,484.4 L 187.5,484.4 L 185.5,482.4 Z M 455.1,210.9 L 421.9,224.6 L 392.6,250.0 L 363.3,296.9 L 353.5,332.0 L 357.4,388.7 L 425.8,484.4 L 425.8,601.6 L 390.6,638.7 L 384.8,652.3 L 384.8,734.4 L 392.6,750.0 L 447.3,800.8 L 535.2,804.7 L 556.6,796.9 L 607.4,746.1 L 613.3,732.4 L 613.3,652.3 L 607.4,638.7 L 570.3,599.6 L 570.3,484.4 L 636.7,394.5 L 642.6,337.9 L 632.8,298.8 L 609.4,259.8 L 578.1,232.4 L 560.5,224.6 L 541.0,224.6 L 529.3,238.3 L 529.3,250.0 L 544.9,298.8 L 544.9,335.9 L 513.7,357.4 L 509.8,392.6 L 498.0,400.4 L 496.1,378.9 L 484.4,363.3 L 496.1,345.7 L 496.1,332.0 L 482.4,316.4 L 496.1,298.8 L 494.1,283.2 L 480.5,269.5 L 488.3,230.5 L 476.6,212.9 Z M 439.5,255.9 L 443.4,257.8 L 439.5,279.3 L 451.2,293.0 L 439.5,310.5 L 439.5,324.2 L 453.1,337.9 L 439.5,355.5 L 439.5,367.2 L 460.9,390.6 L 460.9,400.4 L 449.2,419.9 L 449.2,431.6 L 460.9,443.4 L 509.8,435.5 L 541.0,414.1 L 544.9,378.9 L 578.1,353.5 L 580.1,283.2 L 595.7,302.7 L 605.5,330.1 L 605.5,377.0 L 580.1,416.0 L 543.0,457.0 L 535.2,480.5 L 535.2,605.5 L 541.0,621.1 L 578.1,658.2 L 578.1,726.6 L 533.2,769.5 L 464.8,769.5 L 419.9,726.6 L 419.9,658.2 L 455.1,621.1 L 460.9,607.4 L 460.9,480.5 L 451.2,455.1 L 414.1,414.1 L 392.6,380.9 L 388.7,337.9 L 402.3,296.9 Z M 271.5,123.0 L 248.0,148.4 L 60.5,486.3 L 60.5,519.5 L 70.3,544.9 L 252.0,859.4 L 273.4,880.9 L 304.7,892.6 L 697.3,892.6 L 728.5,880.9 L 753.9,853.5 L 941.4,515.6 L 929.7,459.0 L 750.0,142.6 L 720.7,117.2 L 693.4,109.4 L 308.6,109.4 Z M 294.9,150.4 L 308.6,144.5 L 693.4,144.5 L 724.6,168.0 L 900.4,478.5 L 906.2,513.7 L 722.7,837.9 L 705.1,853.5 L 306.6,857.4 L 275.4,830.1 L 101.6,529.3 L 93.8,502.0 L 277.3,168.0 Z"/></svg>