Jason ZhouandClaude Fable 5
8ca54c0c6f
public_url/email_from defaults, render.yaml, CLI fallbacks, packaging (npm/plugin/pyproject), web pages (+canonical tag), docs and context fragments all move to https://treg.to. The legacy host keeps serving the FULL API forever — installed CLIs, skill.md files and .mcp.json configs in the wild hold Bearer tokens pointed at it, and HTTP clients strip Authorization on cross-host redirects. Only browser-facing marketing pages 301 to treg.to (new middleware + tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
6.6 KiB
tools-registry — dashboard tour
Everything you can do in the web UI, with a screenshot per step. The interactive version (Ledger style,
prev/next, theme toggle) is served at https://treg.to/dashboard-tour/ (Help → Dashboard tour); the CLI walkthrough is
docs/TUTORIAL.md / https://treg.to/tutorial.
Screenshots are generated by docs/dash-tour/capture.py (Playwright) — re-run it after UI changes.
Sign in
1 · Three ways in
The sign-in screen offers three separate doors — pick one: Continue with GitHub (real OAuth), Email me a sign-in code (works for any email), or the collapsible paste an org token (agents & CLI).
Notice: this tour uses the email-code door. No mail server is wired yet, so in dev mode the code is shown on the page instead of emailed.
2 · The email code
Type your email and click Email me a sign-in code — the page shows dev code 619565 plus a field for
it. Enter the 6 digits and Sign in. First sign-in also registers you (+ a personal org).
3 · Your dashboard
You land on your active org. A fresh account has a personal org and no tools. The header has the org switcher, theme toggle, avatar, and Sign out; the left nav has Tools, Organizations, Activity, Tutorial.
Build a team
4 · Create a team
Click + New team and name it — you become its owner and it becomes active. Teams are where you share tools.
Notice: personal orgs are made automatically on sign-in; teams are always created explicitly.
5 · You're the owner
On the Organizations page your active team gets a Manage panel: members, invites, and a danger zone.
Bring people in
6 · Invite a teammate
Enter an email, pick a role (viewer / member / admin), Invite. treg mints a one-time code shown inline; they can also accept it code-free. Pending invites below lists outstanding ones (with Revoke).
7 · Accept via banner
When the invited person signs in, the invite shows as a banner — one click on Accept and they're in. No code to copy.
Notice: invites attach to the email, so proving that email (any door) is enough — the code is just an out-of-band shortcut.
8 · …or join by code
Handed a code out-of-band? Open ⤷ Join by code and paste it (it must match your email).
Register resources
9 · Add a secret
A member+ can register. Open ⚿ Secrets and add a credential (name, value, kind). The value is encrypted server-side and never shown again.
10 · Register a tool
+ Add tool: a tool is an upstream base URL + a binding — the secret, where it goes
(header/query), the field name, and a format like Bearer {secret}.
Notice:
{secret}is replaced with the real credential at call time — the caller never holds it.
11 · Multi-credential tools
Click + binding to add another row — every binding is applied on each call (e.g. an OAuth bearer and a developer-token header).
12 · Edit a tool
The ✎ button reopens the builder pre-filled (base URL + bindings) → PATCH on save. The name stays fixed; delete is the ✕ (inline confirm). A secret still bound by a tool is protected from deletion.
13 · Register a skill (bundle)
A skill = a recipe + its secrets + its tool(s), registered atomically. + Skill → paste the payload
(secret values inline; the CLI's treg.json loads them from files instead). Bindings reference a secret by
local_name; the JSON is validated first.
14 · Your tools
Registered tools are cards — host, injectors, owner, health badge. From each: Copy a snippet, Try it, edit, or delete.
Use tools
15 · Try it — key injected
Try it → type the upstream path → Send. The call runs through the proxy with the credential injected
server-side; the response shows authorization: Bearer … though you never sent a key.
Notice: this is the whole product — call the real API through treg, the secret is added on the server. Even a viewer can do this.
16 · Copy a snippet
Copy for… gives a ready snippet for Claude Code, the CLI, Python, Node, or cURL — pointed at the proxy with your token, no key inlined.
Roles
17 · The viewer role
Signed in as a viewer, you see tools and can Copy / Try it — but the register controls (Secrets,
- Skill, + Add tool) and the Manage panel are gone. Use without the ability to change credentials.
Notice: roles are owner > admin > member > viewer. The UI hides what your role can't do; the server enforces it too.
18 · Manage the team
As owner, the Manage panel lists everyone: change roles from the dropdown (owner-only), Remove members (admin+), and a danger zone with Leave (last-owner guard) and Delete (type-to-confirm).
Super-admin
19 · Platform control
A super-admin gets an Admin nav with cross-tenant reach: platform stats, every org (suspend / delete), and every user (grant/revoke super-admin, suspend, delete). Your own row is guarded against lockout.
Notice: the Admin nav only appears for super-admins.
Wrap up
20 · Activity — the audit log
Activity lists every proxy call in the org — who, what, when, status. Even when someone uses a teammate's key, the ledger records the real caller.
21 · The in-app tutorial
Under Help → Tutorial, the dashboard also ships the full interactive CLI walkthrough — terminal and browser documented in one place.
That's the whole UI: sign in → build a team → invite → register → call → administer → tear down. 🏁