docs(apps): add user guide for the Apps feature#278
Merged
Conversation
Add a top-level "Apps" documentation section aimed at security practitioners (not only developers), documenting the in-console Apps feature end to end: - Overview: what apps are, where they appear, the security model in plain language, and who can use them. - Creating & Managing Apps: the AI-assistant authoring flow, managing apps from the Apps page, a guided read of the consent screen, and choosing where an app appears. - Building Blocks & Recipes: the design system plus copy-paste recipes for KPIs, tables, charts/graphs, search-backed widgets, embedded sensor panels, and external lookups. - Reference: the window.lc runtime (api/chart/ctx/theme), design-system tokens and classes, permission and consent classification, external origins, locations/context, and limits. Wire the section into the nav and cross-link the existing Config Hive: Apps record reference. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y2iVk7q4X7Nyw5JpmzjU9Y
lcbill
previously approved these changes
Jun 19, 2026
Verified every endpoint, response field, and permission against the
backend (lc_api-go, replay), the SDKs, and go-essentials. Corrections:
- Search recipe: the query API is asynchronous and block-structured.
Poll until `completed`, count events by summing `rows` of `events`
blocks (not `results.length`), pass `startTime`/`endTime` as
Unix-second strings, and require `insight.evt.get`.
- Embedded sensor panel: `GET /v1/<sid>` returns
`{ online: { is_online }, info: { hostname } }`, so read
`data.online.is_online` and `data.info.hostname` (not flat fields);
require `sensor.get`.
- Add the `sensor.list` permission note to the chart recipe.
The sensor-list shape (`sensors[].is_online` / `hostname` / `sid`),
`sensor.list` for listing, `who.ident`, and all permission strings were
confirmed correct and left unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y2iVk7q4X7Nyw5JpmzjU9Y
lcbill
previously approved these changes
Jun 19, 2026
Verified against live data (an org with ~127k events/24h): the previous row-counting tally returned only the first page's event count, not the true total. Switch the recipe to an aggregating LCQL query (`COUNT(event) as count`) and read the single aggregate row (`results[].rows[0].data.count`), which is exact regardless of volume. Relabel "Detections" to "Events" to match the all-events query. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y2iVk7q4X7Nyw5JpmzjU9Y
lcbill
previously approved these changes
Jun 19, 2026
- KPI, Search, and embedded-panel recipes now start with a .lc-spinner and wrap calls in try/catch, so an app shows progress and surfaces errors instead of sitting on a blank dash. - Chart recipe: note that pie/doughnut charts get one color per slice and that you can pass an explicit backgroundColor array (e.g. green/red). - External-service recipe: note the site must send CORS headers and be reachable (DoH endpoints are commonly network-blocked). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y2iVk7q4X7Nyw5JpmzjU9Y
lcbill
previously approved these changes
Jun 19, 2026
Inline a screenshot under each recipe in the Building Blocks & Recipes page (Hello sample, KPI dashboard, sensors table, doughnut chart, event count, embedded sensor panel, and the external IP lookup). Point the "call an external service" recipe at ipinfo.io (free, CORS-enabled) so the example works as-is, replacing the placeholder intel.example.com that always failed to fetch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018GcEtE5BRz6CdvTxx37b2p
lcbill
approved these changes
Jun 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new top-level Apps documentation section that documents the in-console Apps feature for end users — security practitioners who may not be developers. It complements the existing Config Hive → Apps record reference (which stays the canonical record/format and API/SDK/CLI management reference) by covering the experience: building apps conversationally with the AI assistant, what the app runtime makes available, and how to accomplish the most common requests.
Pages
apps/index.md) — what an app is, where apps appear (the Apps launcher and embedded object panels), the security model in plain language (sandbox, brokered permission-scoped credentials, consent), Labs status, and the permissions needed to use the feature.apps/creating-and-managing-apps.md) — the AI-assistant authoring flow (plus a pointer to the CLI/API path), managing apps from the Apps page, a guided walkthrough of the consent screen, and placing an app standalone vs. embedded.apps/building-blocks-and-recipes.md) — the design system at a glance and copy-paste recipes for KPI dashboards, tables, charts/graphs, historical-event widgets via Search, embedded sensor panels, and external lookups.apps/reference.md) — the record fields, thewindow.lcruntime (api/chart/ctx/onThemeChange), services and limits, design-system tokens and classes, permission and consent classification, external-origin rules, locations/context, and validation limits.Also
Validation
markdownlint-cli2passes (0 errors).mkdocs buildsucceeds with no broken links or nav warnings for the new pages.🤖 Generated with Claude Code
https://claude.ai/code/session_01Y2iVk7q4X7Nyw5JpmzjU9Y